Analysis
-
max time kernel
155s -
max time network
158s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
-
submitted
22-12-2023 13:32
General
-
Target
a538c26af968f61af3479445e495a294
-
Size
1.2MB
-
MD5
a538c26af968f61af3479445e495a294
-
SHA1
f67535a87198ef8788620bf0a35131d9c6006a97
-
SHA256
61bc77c9b7589a6987dae9bae6b194136f0bba1a1dad8fdc67de7038b572a493
-
SHA512
ee8a860385bba87a9e7f8d3cf0c22ba3ad10a18d9513857bfa9f73b124994f65a0f477dd46f6ed3f585aa556d4c31209d970f4ccfa9a6f441a571a18f7dc32de
-
SSDEEP
24576:e845rUHu6gVJKG75oFpA0VWPX4G2y1q2rJp0:7451RVJKGtSA0VWPoVu9p0
Malware Config
Signatures
-
MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
-
MrBlack trojan 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Modifies init.d 1 TTPs 2 IoCs
Adds/modifies system service, likely for persistence.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Write file to user bin folder 1 TTPs 9 IoCs
-
Writes file to system bin folder 1 TTPs 2 IoCs
-
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 23 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/a538c26af968f61af3479445e495a294/tmp/a538c26af968f61af3479445e495a2941⤵
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /tmp/a538c26af968f61af3479445e495a294 /usr/bin/bsd-port/getty"1⤵
-
/bin/cpcp -f /tmp/a538c26af968f61af3479445e495a294 /usr/bin/bsd-port/getty2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c /usr/bin/bsd-port/getty1⤵
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty2⤵
- Executes dropped EXE
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /tmp/a538c26af968f61af3479445e495a294 /usr/bin/.sshd"1⤵
-
/bin/cpcp -f /tmp/a538c26af968f61af3479445e495a294 /usr/bin/.sshd2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux2⤵
-
-
/bin/shsh -c /usr/bin/.sshd1⤵
-
/usr/bin/.sshd/usr/bin/.sshd2⤵
- Executes dropped EXE
-
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"1⤵
-
/bin/mkdirmkdir -p /usr/bin/dpkgd2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"1⤵
-
/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "mkdir -p /bin"1⤵
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "mkdir -p /bin"1⤵
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"1⤵
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ps2⤵
- Writes file to system bin folder
- Reads runtime system information
-
-
/bin/shsh -c "chmod 0755 /bin/ps"1⤵
-
/bin/chmodchmod 0755 /bin/ps2⤵
-
-
/bin/shsh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"1⤵
-
/bin/cpcp -f /bin/ss /usr/bin/dpkgd/ss2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "mkdir -p /bin"1⤵
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "mkdir -p /bin"1⤵
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"1⤵
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ss2⤵
- Writes file to system bin folder
- Reads runtime system information
-
-
/bin/shsh -c "chmod 0755 /bin/ss"1⤵
-
/bin/chmodchmod 0755 /bin/ss2⤵
-
-
/bin/shsh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"1⤵
-
/bin/cpcp -f /usr/bin/lsof /usr/bin/dpkgd/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"1⤵
-
/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"1⤵
-
/bin/chmodchmod 0755 /usr/bin/lsof2⤵
-
-
/bin/shsh -c "insmod /tmp/xpacket.ko"1⤵
-
/sbin/insmodinsmod /tmp/xpacket.ko2⤵
- Reads runtime system information
-
-
/bin/shsh -c "insmod /usr/bin/bsd-port/xpacket.ko"1⤵
-
/sbin/insmodinsmod /usr/bin/bsd-port/xpacket.ko2⤵
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD5c81ae765d2f61a83bad30628eea7380a
SHA183bbbaacb0b7988dc6f499addc96644aad895542
SHA256d7844aeb569124745c112d0766de2e8412361aa46cb6e3dcd9cb9d7f0b00ed8d
SHA5126b6bd5ac78f2a63f91b590e3482028ae2a6fa4e4fa3f2a00643fb77871af219bbb8754dc73a4038f81ce62a12d4b6d5820a323d44d907fc57cad5e96adf1862b
-
Filesize
4B
MD5d010396ca8abf6ead8cacc2c2f2f26c7
SHA1731df0fc93417f72fcb56f09cd754f9382ae6373
SHA256596d0c702ba6d20835982c87a878f97d07a163285a0a3ee98c6e7a8e0459a8cb
SHA512843da40f223209d8e90012e1a35004387636ffcb23cce0602a3964055ed790d271e5fd274351b8dd3afc4200e0a9d28811f7a0987f44d813e4257f10dedabeba
-
Filesize
37B
MD5c326283fd9e8602ebbfc1e845ee3d6cb
SHA1f19ab189956326244315504461956521aade8635
SHA2563ff09b1afd1ec65d4f0cdb8c9dd52ec2431502fd893cc16e4a00d1a0bec5f6ca
SHA5126d0dac48136ce922b7118657d2effdb9119d3f1fab9d04fb6615ab4736808183e3726e85e09f31013b731d45b5c6a1d9811615804ef87a4da2249a5b6d029c30
-
Filesize
73B
MD5157153855148ab8dc2c7bb1d95da7805
SHA1b2fd7d93c61ac13864414a70b29f1d939f9e46f4
SHA2567dcf367359f48e78459f77c738df2d109fb3b91986eee502cf2203f845348369
SHA512ee01b2464203d09e57b02df28255a526dc6d0f9b1930bb8c1e68f5cad42c7f29646da44ffcf55a7624db2d89b9053b8929474a42213f3716538a604de9d5d6aa
-
Filesize
1.2MB
MD5a538c26af968f61af3479445e495a294
SHA1f67535a87198ef8788620bf0a35131d9c6006a97
SHA25661bc77c9b7589a6987dae9bae6b194136f0bba1a1dad8fdc67de7038b572a493
SHA512ee8a860385bba87a9e7f8d3cf0c22ba3ad10a18d9513857bfa9f73b124994f65a0f477dd46f6ed3f585aa556d4c31209d970f4ccfa9a6f441a571a18f7dc32de
-
Filesize
159KB
MD5e093dc78225e2a0a25e3b137c1c1e442
SHA1c29497cfaae729eb576875e4fdfa400640ab16be
SHA2561190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
SHA512fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
-
Filesize
136KB
MD51dc929b5f2cd12fe6a2fe71140d2a9e3
SHA1f9995a92bb201b1b7738a39a38570ef0c40b52d2
SHA256418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38
SHA512fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373