Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
158s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
22/12/2023, 13:54
Behavioral task
behavioral1
Sample
b165fc62f6326b18308133acfd228b58
Resource
ubuntu1804-amd64-20231215-en
General
-
Target
b165fc62f6326b18308133acfd228b58
-
Size
1.5MB
-
MD5
b165fc62f6326b18308133acfd228b58
-
SHA1
da26fbdebf2350f1fab998943d45d8e5ae2dabe9
-
SHA256
393ac47184475af099eafce91d7472ea5af1d74636a992cc08bf40872d22fa4a
-
SHA512
b7d0a59f1e95d1e37e5925fab7a7ee5666ced7c07303a0ca786012b17d8389f1a04abf1209bd8f9945b61465e47af9c6dc7a9d9137ff271d88ce941d2b747d16
-
SSDEEP
49152:2nilOolLbt1laIunbZsehk1S55555555555555555555555555555555555k55w1:yeOolLbt1laIunlseh9NtYi7COEm
Malware Config
Signatures
-
MrBlack trojan 1 IoCs
resource yara_rule behavioral1/files/fstream-4.dat family_mrblack -
Executes dropped EXE 2 IoCs
ioc pid Process /usr/bin/bsd-port/getty 1560 getty /usr/bin/.sshd 1590 .sshd -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc File opened for reading /proc/cpuinfo -
description ioc File opened for modification /etc/init.d/DbSecuritySpt File opened for modification /etc/init.d/selinux -
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc File opened for reading /proc/net/route -
Write file to user bin folder 1 TTPs 8 IoCs
description ioc Process File opened for modification /usr/bin/lsof cp File opened for modification /usr/bin/bsd-port/getty.lock Process not Found File opened for modification /usr/bin/bsd-port/udevd.lock Process not Found File opened for modification /usr/bin/bsd-port/getty cp File opened for modification /usr/bin/.sshd cp File opened for modification /usr/bin/dpkgd/ps cp File opened for modification /usr/bin/dpkgd/ss cp File opened for modification /usr/bin/dpkgd/lsof cp -
Writes file to system bin folder 1 TTPs 2 IoCs
description ioc Process File opened for modification /bin/ps cp File opened for modification /bin/ss cp -
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/dev File opened for reading /proc/net/route File opened for reading /proc/net/arp -
Reads runtime system information 23 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/stat Process not Found File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/cmdline insmod File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/meminfo Process not Found -
Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
description ioc File opened for modification /tmp/notify.file File opened for modification /tmp/conf.n File opened for modification /tmp/moni.lod File opened for modification /tmp/bill.lock File opened for modification /tmp/gates.lod
Processes
-
/tmp/b165fc62f6326b18308133acfd228b58/tmp/b165fc62f6326b18308133acfd228b581⤵PID:1537
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"1⤵PID:1542
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt2⤵PID:1543
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"1⤵PID:1544
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt2⤵PID:1545
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"1⤵PID:1546
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt2⤵PID:1547
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"1⤵PID:1548
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt2⤵PID:1549
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"1⤵PID:1550
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt2⤵PID:1551
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵PID:1552
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
PID:1553
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵PID:1554
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
PID:1555
-
-
/bin/shsh -c "cp -f /tmp/b165fc62f6326b18308133acfd228b58 /usr/bin/bsd-port/getty"1⤵PID:1556
-
/bin/cpcp -f /tmp/b165fc62f6326b18308133acfd228b58 /usr/bin/bsd-port/getty2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1557
-
-
/bin/shsh -c /usr/bin/bsd-port/getty1⤵PID:1559
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty2⤵
- Executes dropped EXE
PID:1560
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1562
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1563
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1564
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1565
-
-
/bin/shsh -c "cp -f /tmp/b165fc62f6326b18308133acfd228b58 /usr/bin/.sshd"1⤵PID:1566
-
/bin/cpcp -f /tmp/b165fc62f6326b18308133acfd228b58 /usr/bin/.sshd2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1567
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"1⤵PID:1568
-
/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux2⤵PID:1569
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"1⤵PID:1570
-
/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux2⤵PID:1571
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"1⤵PID:1572
-
/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux2⤵PID:1573
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"1⤵PID:1574
-
/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux2⤵PID:1575
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"1⤵PID:1576
-
/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux2⤵PID:1577
-
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"1⤵PID:1578
-
/bin/mkdirmkdir -p /usr/bin/dpkgd2⤵
- Reads runtime system information
PID:1579
-
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"1⤵PID:1580
-
/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1581
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1582
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1583
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1584
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1585
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"1⤵PID:1586
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ps2⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1587
-
-
/bin/shsh -c /usr/bin/.sshd1⤵PID:1589
-
/usr/bin/.sshd/usr/bin/.sshd2⤵
- Executes dropped EXE
PID:1590
-
-
/bin/shsh -c "chmod 0755 /bin/ps"1⤵PID:1591
-
/bin/chmodchmod 0755 /bin/ps2⤵PID:1592
-
-
/bin/shsh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"1⤵PID:1593
-
/bin/cpcp -f /bin/ss /usr/bin/dpkgd/ss2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1594
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1595
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1596
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1597
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1598
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"1⤵PID:1599
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ss2⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1600
-
-
/bin/shsh -c "chmod 0755 /bin/ss"1⤵PID:1601
-
/bin/chmodchmod 0755 /bin/ss2⤵PID:1602
-
-
/bin/shsh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"1⤵PID:1603
-
/bin/cpcp -f /usr/bin/lsof /usr/bin/dpkgd/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1604
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1605
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1606
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1607
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1608
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"1⤵PID:1609
-
/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1610
-
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"1⤵PID:1611
-
/bin/chmodchmod 0755 /usr/bin/lsof2⤵PID:1612
-
-
/bin/shsh -c "insmod /usr/bin/bsd-port/xpacket.ko"1⤵PID:1616
-
/sbin/insmodinsmod /usr/bin/bsd-port/xpacket.ko2⤵
- Reads runtime system information
PID:1617
-
-
/bin/shsh -c "insmod /tmp/xpacket.ko"1⤵PID:1628
-
/sbin/insmodinsmod /tmp/xpacket.ko2⤵
- Reads runtime system information
PID:1629
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD5ffa44c010815fa042d4cac18f9d4f17a
SHA1d21bda41b9ee41ff842d1e166db76836d9de55e2
SHA25689e0613e6c1511e8551e5e5e0298db3d7a292bbd41afaf3aad4ee2e1dff85e0e
SHA5121b560f87ab3695f722879b7e2685c2e89c1f9f631dcaf119f928ee9ac252a3c707c84ec94cf48e93f1f4a675221c20ae04eaf5f73d78320b33814d7b26d30ab5
-
Filesize
4B
MD5b60c5ab647a27045b462934977ccad9a
SHA1aff60c26ab00f0ad980af68c68a926fa11795ef9
SHA2560f8e631d28e2a339b435ea55da61c718da28902056ed719e576ff1c1b4cb2baf
SHA512d8e0a85d197bbd49b2c4586c3e6e29dcdfa203b80c4d3480a4f48f0aeefd87ce3261e56bae531551d6eb007afd221a16df4447d1d4882c846a144754d16b8431
-
Filesize
4B
MD569d658d0b2859e32cd4dc3b970c8496c
SHA12a7bcf3804dc71895222bdd5f95e64444ce51654
SHA25696382608813353bee4eeaf0635a3b3356276fece94fe8c9cf048871078f8fd14
SHA5121222e306ef8fe358e297a275b61a3bb9aca3ec2b38ed1056fd2816b7bba7b32104218680531d8f8f12cea6e4e726c06daea88cf427163bd3365d0675350a428c
-
Filesize
37B
MD5115b40fd132b540501a8377c587b677c
SHA1827ba0c424505dc3ddc7799cbd90c82a6ff36abf
SHA2561f5c6760f61f66157605899a56fec5574df42a595c90536b63dd97c310a05203
SHA512e5bc72d1e6fb2f3b88c54fefc8a0922121e98d6d1df6a4d9bf2c0a185418fadcf4d52affe0f3fa11a8dad38730386395a3f5a2ad6140769b1fc7edeeccd40dc9
-
Filesize
1.5MB
MD5b165fc62f6326b18308133acfd228b58
SHA1da26fbdebf2350f1fab998943d45d8e5ae2dabe9
SHA256393ac47184475af099eafce91d7472ea5af1d74636a992cc08bf40872d22fa4a
SHA512b7d0a59f1e95d1e37e5925fab7a7ee5666ced7c07303a0ca786012b17d8389f1a04abf1209bd8f9945b61465e47af9c6dc7a9d9137ff271d88ce941d2b747d16
-
Filesize
159KB
MD5e093dc78225e2a0a25e3b137c1c1e442
SHA1c29497cfaae729eb576875e4fdfa400640ab16be
SHA2561190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
SHA512fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
-
Filesize
130KB
MD5558edc26f8a38fa9788220b9af8a73e7
SHA13024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA256b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
SHA512edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f
-
Filesize
136KB
MD51dc929b5f2cd12fe6a2fe71140d2a9e3
SHA1f9995a92bb201b1b7738a39a38570ef0c40b52d2
SHA256418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38
SHA512fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373