mrblack | e06f76599cb5c522b9e739db71afd98be6d77807a5eeb610dfa12c16730b7e14 | Triage

Analysis

max time kernel
155s
max time network
160s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22-12-2023 13:55

Sharing

Report Analysis Logs

General

Target

udp
Size

1.2MB
MD5

6205df8b077b2ca968077127dd03ab84
SHA1

4db1c73a4a33696da9208cc220f8262fb90767af
SHA256

da2a3acb7a40ceca3d89f84583703ddc1003a5448e9b1dcda7dea986a4d84f82
SHA512

9b0ec70890246e2cde9d2df1faabac9fabfd9fe80a7649200f4ae9b81dcbe9cd7c0788fac19ebd5e05be1475a62ffa3b0df0fc0b278894aaa66d996792a4d7b7
SSDEEP

24576:e845rlHu6gVJKG75oFpA0VWEX4G2y1q2rJp0:745wRVJKGtSA0VWEoVu9p0

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

resource	yara_rule
behavioral11/files/fstream-4.dat	family_mrblack

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	1616	getty
/etc/.ssh	1638	.ssh

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

Virtualization/Sandbox Evasion

description	ioc
File opened for reading	/proc/cpuinfo

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

Boot or Logon Autostart Execution

description	ioc
File opened for modification	/etc/init.d/DbSecuritySpt
File opened for modification	/etc/init.d/selinux

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery

description	ioc
File opened for reading	/proc/net/route

Write file to user bin folder 1 TTPs 8 IoCs

Hijack Execution Flow

description	ioc	Process
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/conf.n	Process not Found
File opened for modification	/usr/bin/bsd-port/getty.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/udevd.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/getty	cp

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

description	ioc	Process
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp

Reads system network configuration 1 TTPs 3 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

description	ioc
File opened for reading	/proc/net/dev
File opened for reading	/proc/net/route
File opened for reading	/proc/net/arp

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/stat	Process not Found
File opened for reading	/proc/meminfo	Process not Found
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/gates.lod
File opened for modification	/tmp/notify.file
File opened for modification	/tmp/conf.n
File opened for modification	/tmp/moni.lod
File opened for modification	/tmp/bill.lock

/tmp/udp
/tmp/udp
1⤵
PID:1593

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
1⤵
PID:1598
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:1599

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
1⤵
PID:1600
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:1601

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
1⤵
PID:1602
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:1603

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
1⤵
PID:1604
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:1605

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
1⤵
PID:1606
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:1607

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1608
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1609

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1610
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1611

/bin/sh
sh -c "cp -f /tmp/udp /usr/bin/bsd-port/getty"
1⤵
PID:1612
- /bin/cp
  cp -f /tmp/udp /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1613

/bin/sh
sh -c /usr/bin/bsd-port/getty
1⤵
PID:1615
- /usr/bin/bsd-port/getty
  /usr/bin/bsd-port/getty
  2⤵
  - Executes dropped EXE
  PID:1616

/bin/sh
sh -c "mkdir -p /etc"
1⤵
PID:1618
- /bin/mkdir
  mkdir -p /etc
  2⤵
  - Reads runtime system information
  PID:1619

/bin/sh
sh -c "mkdir -p /etc"
1⤵
PID:1620
- /bin/mkdir
  mkdir -p /etc
  2⤵
  - Reads runtime system information
  PID:1621

/bin/sh
sh -c "cp -f /tmp/udp /etc/.ssh"
1⤵
PID:1622
- /bin/cp
  cp -f /tmp/udp /etc/.ssh
  2⤵
  - Reads runtime system information
  PID:1623

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
1⤵
PID:1624
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
  2⤵
  PID:1625

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
1⤵
PID:1626
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
  2⤵
  PID:1627

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
1⤵
PID:1628
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
  2⤵
  PID:1629

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
1⤵
PID:1630
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
  2⤵
  PID:1631

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
1⤵
PID:1632
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
  2⤵
  PID:1633

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
1⤵
PID:1634
- /bin/mkdir
  mkdir -p /usr/bin/dpkgd
  2⤵
  - Reads runtime system information
  PID:1637

/bin/sh
sh -c /etc/.ssh
1⤵
PID:1636
- /etc/.ssh
  /etc/.ssh
  2⤵
  - Executes dropped EXE
  PID:1638

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
1⤵
PID:1639
- /bin/cp
  cp -f /bin/ps /usr/bin/dpkgd/ps
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1640

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1641
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1642

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1643
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1644

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
1⤵
PID:1645
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ps
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1646

/bin/sh
sh -c "chmod 0755 /bin/ps"
1⤵
PID:1647
- /bin/chmod
  chmod 0755 /bin/ps
  2⤵
  PID:1648

/bin/sh
sh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"
1⤵
PID:1649
- /bin/cp
  cp -f /bin/ss /usr/bin/dpkgd/ss
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1650

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1651
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1652

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1653
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1654

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"
1⤵
PID:1655
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ss
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1656

/bin/sh
sh -c "chmod 0755 /bin/ss"
1⤵
PID:1657
- /bin/chmod
  chmod 0755 /bin/ss
  2⤵
  PID:1658

/bin/sh
sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
1⤵
PID:1659
- /bin/cp
  cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1660

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1661
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1662

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1663
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1664

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
1⤵
PID:1665
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1666

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
1⤵
PID:1667
- /bin/chmod
  chmod 0755 /usr/bin/lsof
  2⤵
  PID:1668

/bin/sh
sh -c "insmod /usr/bin/bsd-port/xpacket.ko"
1⤵
PID:1671
- /sbin/insmod
  insmod /usr/bin/bsd-port/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1672

/bin/sh
sh -c "insmod /tmp/xpacket.ko"
1⤵
PID:1673
- /sbin/insmod
  insmod /tmp/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1674

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Hijack Execution Flow

Privilege Escalation

Boot or Logon Autostart Execution

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Virtualization/Sandbox Evasion

Credential Access

Discovery

System Network Configuration Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
21B

MD5
042cbe47afd6b512436d51dcec08bb6f

SHA1
174fd8a43f4982a476650992434b0dd458a6e574

SHA256
76eb7ebb6d11b7a5274447835535a2caad0b427dc0ba64aa081cebd3898ff017

SHA512
c1cbb19202656eb32359dfb730cbee283387d52c01497418fed4116911e4f9e398bc4330ecb03ed20532c5ee2120a9a54e066f83ce258f3744911ec7df4b41b7

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/gates.lod

Filesize
4B

MD5
0ebcc77dc72360d0eb8e9504c78d38bd

SHA1
8b583aa0ac7f15508192f2ea1c56b9a07eb48e38

SHA256
8698616a6419549cd9c035d5e250c81c6cefff11ff31c9602bf2ff5aa3e06b7f

SHA512
18bc49d42d4b488f1264cf1f0fb6f914aa29d320e8721f75da80e9324a63c027670f82f6a0549837caac67f83e83dd67480305c079d65a380b54ff013ca11727

Download Submit
/tmp/moni.lod

Filesize
4B

MD5
cdf1035c34ec380218a8cc9a43d438f9

SHA1
833e3c6a387a4b786fe37029cb29b175c4ca4eef

SHA256
411922c1ae8248b994a04fe6f08864503f7c0f41a5dd37f126d5f9b18f8c65f4

SHA512
59fbcc61bbeaafd6e5ab3e97e71cdd0815447d642e64881b91182be68cc880a0da2aeeae65d7fe18cf9f3afaf387e22a88cc9de601eb746789cb6040daf354fc

Download Submit
/tmp/notify.file

Filesize
8B

MD5
bad0ecde8792400ff26e74f91408cd50

SHA1
7834e99322146e324aabc749e9021b1a4b67f5bd

SHA256
777a3bcb7d3fff765971c164c2fc11d766570bed850ffc0a7ee4c7fd4b88ec8b

SHA512
ac8d43dd9f99825c8ab690ffdd7e68befcfb709063b1a4f469e5d6a89ae4fef9773920186e826ec150490342bd2a5772c5f70cf77d59ed687e933f1d74e56367

Download Submit
/usr/bin/bsd-port/conf.n

Filesize
73B

MD5
b2e94d610719b0a8733e97a6afd8886c

SHA1
d3fd3a5320ce1b4aaacdbe90d9f738664aa7477d

SHA256
8534055a300c8070fb00770ef482d05fcd10e1b36e182f67b7e484e62e01f123

SHA512
0f77dfea6e2772b615b9ab0b3c8138625a0a1dd0e8ed860e6a4bf7006afb38851543f29b4d8198586a305edd19ad730fd8b84d99363426e0d1b52b6f1cd137a8

Download Submit
/usr/bin/bsd-port/getty

Filesize
1.2MB

MD5
6205df8b077b2ca968077127dd03ab84

SHA1
4db1c73a4a33696da9208cc220f8262fb90767af

SHA256
da2a3acb7a40ceca3d89f84583703ddc1003a5448e9b1dcda7dea986a4d84f82

SHA512
9b0ec70890246e2cde9d2df1faabac9fabfd9fe80a7649200f4ae9b81dcbe9cd7c0788fac19ebd5e05be1475a62ffa3b0df0fc0b278894aaa66d996792a4d7b7

Download Submit
/usr/bin/dpkgd/lsof

Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps

Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit
/usr/bin/dpkgd/ss

Filesize
136KB

MD5
1dc929b5f2cd12fe6a2fe71140d2a9e3

SHA1
f9995a92bb201b1b7738a39a38570ef0c40b52d2

SHA256
418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38

SHA512
fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373

Download Submit