mrblack | 4d5ffa44be5a98eb77b2efd1d30d5577d4fd7439e7976cf0840a81b82f5971aa

Analysis

max time kernel
151s
max time network
149s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231222-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231222-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22-12-2023 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c67271b0f7ffbc565f7d7ccbee12cbab
Size

1.1MB
MD5

c67271b0f7ffbc565f7d7ccbee12cbab
SHA1

2a4650b048edfec4a508fe758c3adc7e231bc4e9
SHA256

4d5ffa44be5a98eb77b2efd1d30d5577d4fd7439e7976cf0840a81b82f5971aa
SHA512

7269ace3b783a72e899bfa30b6bf95622cc8e594c4ba2cb24b875be230f15ff33c3ebbddbff49a0812bfbb33594039b4951f577f45b58a94d914a8421ac3886c
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfavI+gIGYuuCol7r:4vREKfPqVE5jKsfavRHGVo7r

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

Processes:

resource	yara_rule
/usr/bin/bsd-port/agent	family_mrblack

Executes dropped EXE 2 IoCs

Processes:

agentacpid

ioc pid process

/usr/bin/bsd-port/agent 1634 agent
/usr/bin/acpid 1643 acpid
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

description ioc

File opened for reading /proc/cpuinfo
Modifies init.d 1 TTPs 2 IoCs
Adds/modifies system service, likely for persistence.
persistence

Boot or Logon Autostart Execution
T1547

Processes:

description ioc

File opened for modification /etc/init.d/DbSecurityMdt
File opened for modification /etc/init.d/selinux
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

description ioc

File opened for reading /proc/net/route

ioc	pid	process
/usr/bin/bsd-port/agent	1634	agent
/usr/bin/acpid	1643	acpid

description	ioc
File opened for reading	/proc/cpuinfo

description	ioc
File opened for modification	/etc/init.d/DbSecurityMdt
File opened for modification	/etc/init.d/selinux

description	ioc
File opened for reading	/proc/net/route

Write file to user bin folder 1 TTPs 8 IoCs

Hijack Execution Flow

T1574

Processes:

cpcpcpcpcp

description	ioc	process
File opened for modification	/usr/bin/bsd-port/agent	cp
File opened for modification	/usr/bin/acpid	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/conf.n
File opened for modification	/usr/bin/bsd-port/agent.conf
File opened for modification	/usr/bin/bsd-port/udevd.conf

Writes file to system bin folder 1 TTPs 1 IoCs

Hijack Execution Flow
T1574

Processes:

cp

description ioc process

File opened for modification /bin/ps cp
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

description ioc

File opened for reading /proc/net/dev
File opened for reading /proc/net/route
File opened for reading /proc/net/arp

description	ioc	process
File opened for modification	/bin/ps	cp

description	ioc
File opened for reading	/proc/net/dev
File opened for reading	/proc/net/route
File opened for reading	/proc/net/arp

Reads runtime system information 15 IoCs

Reads data from /proc virtual filesystem.

Processes:

cpcpcpcpmkdirmkdirinsmodmkdirmkdircpinsmodmkdircp

description	ioc	process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

Processes:

description	ioc
File opened for modification	/tmp/moni.note
File opened for modification	/tmp/bill.note
File opened for modification	/tmp/gates.note
File opened for modification	/tmp/notify.file
File opened for modification	/tmp/conf.n

/tmp/c67271b0f7ffbc565f7d7ccbee12cbab
/tmp/c67271b0f7ffbc565f7d7ccbee12cbab
1⤵
PID:1604

/bin/sh
sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc1.d/S97DbSecurityMdt"
1⤵
PID:1618

/bin/ln
ln -s /etc/init.d/DbSecurityMdt /etc/rc1.d/S97DbSecurityMdt
2⤵
PID:1619

/bin/sh
sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc2.d/S97DbSecurityMdt"
1⤵
PID:1620

/bin/ln
ln -s /etc/init.d/DbSecurityMdt /etc/rc2.d/S97DbSecurityMdt
2⤵
PID:1621

/bin/sh
sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc3.d/S97DbSecurityMdt"
1⤵
PID:1622

/bin/ln
ln -s /etc/init.d/DbSecurityMdt /etc/rc3.d/S97DbSecurityMdt
2⤵
PID:1623

/bin/sh
sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc4.d/S97DbSecurityMdt"
1⤵
PID:1624

/bin/ln
ln -s /etc/init.d/DbSecurityMdt /etc/rc4.d/S97DbSecurityMdt
2⤵
PID:1625

/bin/sh
sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc5.d/S97DbSecurityMdt"
1⤵
PID:1626

/bin/ln
ln -s /etc/init.d/DbSecurityMdt /etc/rc5.d/S97DbSecurityMdt
2⤵
PID:1627

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1628

/bin/mkdir
mkdir -p /usr/bin/bsd-port
2⤵
- Reads runtime system information
PID:1629

/bin/sh
sh -c "cp -f /tmp/c67271b0f7ffbc565f7d7ccbee12cbab /usr/bin/bsd-port/agent"
1⤵
PID:1630

/bin/cp
cp -f /tmp/c67271b0f7ffbc565f7d7ccbee12cbab /usr/bin/bsd-port/agent
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1631

/bin/sh
sh -c /usr/bin/bsd-port/agent
1⤵
PID:1633

/usr/bin/bsd-port/agent
/usr/bin/bsd-port/agent
2⤵
- Executes dropped EXE
PID:1634

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1636

/bin/mkdir
mkdir -p /usr/bin
2⤵
- Reads runtime system information
PID:1637

/bin/sh
sh -c "cp -f /tmp/c67271b0f7ffbc565f7d7ccbee12cbab /usr/bin/acpid"
1⤵
PID:1638

/bin/cp
cp -f /tmp/c67271b0f7ffbc565f7d7ccbee12cbab /usr/bin/acpid
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1639

/bin/sh
sh -c /usr/bin/acpid
1⤵
PID:1642

/usr/bin/acpid
/usr/bin/acpid
2⤵
- Executes dropped EXE
PID:1643

/bin/sh
sh -c "insmod /usr/lib/xpacket.ko"
1⤵
PID:1645

/sbin/insmod
insmod /usr/lib/xpacket.ko
2⤵
- Reads runtime system information
PID:1646

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
1⤵
PID:1647

/bin/ln
ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
2⤵
PID:1648

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
1⤵
PID:1650

/bin/ln
ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
2⤵
PID:1651

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
1⤵
PID:1652

/bin/ln
ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
2⤵
PID:1653

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
1⤵
PID:1655

/bin/ln
ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
2⤵
PID:1656

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
1⤵
PID:1657

/bin/ln
ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
2⤵
PID:1659

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
1⤵
PID:1662

/bin/mkdir
mkdir -p /usr/bin/dpkgd
2⤵
- Reads runtime system information
PID:1664

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
1⤵
PID:1666

/bin/cp
cp -f /bin/ps /usr/bin/dpkgd/ps
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1667

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1668

/bin/mkdir
mkdir -p /bin
2⤵
- Reads runtime system information
PID:1669

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/agent /bin/ps"
1⤵
PID:1670

/bin/cp
cp -f /usr/bin/bsd-port/agent /bin/ps
2⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1671

/bin/sh
sh -c "chmod 0755 /bin/ps"
1⤵
PID:1672

/bin/chmod
chmod 0755 /bin/ps
2⤵
PID:1673

/bin/sh
sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
1⤵
PID:1674

/bin/cp
cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1675

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1676

/bin/mkdir
mkdir -p /usr/bin
2⤵
- Reads runtime system information
PID:1677

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/agent /usr/bin/lsof"
1⤵
PID:1678

/bin/cp
cp -f /usr/bin/bsd-port/agent /usr/bin/lsof
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1679

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
1⤵
PID:1680

/bin/chmod
chmod 0755 /usr/bin/lsof
2⤵
PID:1681

/bin/sh
sh -c "insmod /usr/lib/xpacket.ko"
1⤵
PID:1682

/sbin/insmod
insmod /usr/lib/xpacket.ko
2⤵
- Reads runtime system information
PID:1683

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Hijack Execution Flow

T1574

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecurityMdt
Filesize
50B

MD5
296eb8b6e08421b815eda65663b36d90

SHA1
0bcc84c04033d683cc300c535098fc736d274f7b

SHA256
5b874bc8253bfee6b8128a4fd7bdd33909df167510fea779f5b6096afa378e13

SHA512
30cbce3dc8158490886615297c72308cf45d4d5fa0135d0e21ab02d1ed245648234c397d9815d8bdfa1655da7ae4cbfceb0d7845c1437952f250a4ee03badf9c

Download Submit
/etc/init.d/selinux
Filesize
36B

MD5
c6a80f08539a4c3176762f514976dd24

SHA1
bbc5826b01d20f5c4d315ff5dbc3f216760c64ef

SHA256
ea47e885ae227059ce55d020335f7869c565ec6d85f484497e83cd4998149d5d

SHA512
9a1e3b0142876305fe389e07880bd586e97bf709273a66299d9128ff2861459104054d4e5d836aecdf73f2c11886fa3a2a8498741adb3211b96116658b856175

Download Submit
/tmp/gates.note
Filesize
4B

MD5
f18a6d1cde4b205199de8729a6637b42

SHA1
2fdd02f8f1222ac5b66ec221c8ff66d62695b11c

SHA256
5909daa6fb5cf239d52027367f111ecd9c280866d73f8bd47cda43ef5495af6a

SHA512
3407704df3075afe3710ea8c7b64a54f572e311c24de4299fafb95203ac100326b1a9aec57289285ad641b51de049eb2b3ee66180b74c7bfda1b82b8664b9fc2

Download Submit
/tmp/moni.note
Filesize
4B

MD5
89f03f7d02720160f1b04cf5b27f5ccb

SHA1
cbf641003962d3b22ea5aeb9164c4cff46a13515

SHA256
f7d9615965e2b49c6bde79dedfdecc39afade6e543922d5d023fda9d13430c44

SHA512
b86aa582e4cbffc73c377a673ee2364627f267fe71a97a95b1cfcbb2c79373da88190563f456a178d9d734daeeb5f1e12df41d61ce6c4b50cbcd03f506cb0642

Download Submit
/tmp/notify.file
Filesize
37B

MD5
6b19e60c20680111a6ae5f41a767437d

SHA1
ac6e0b5848bece496cb490aec57cb4f26182a201

SHA256
e7ffbeae76b8364fa9e08bf9c83d87ee3b84d379500711ce21697404fb71db4c

SHA512
0b53b7edd0ab24ee8ae15626af04166754a056b1d61953b8e72b25676d00f801aae8b95bce6051ed0082f4fbae6a338c1d03de98e3c4f068fa385cdded7a5972

Download Submit
/usr/bin/bsd-port/agent
Filesize
1.1MB

MD5
c67271b0f7ffbc565f7d7ccbee12cbab

SHA1
2a4650b048edfec4a508fe758c3adc7e231bc4e9

SHA256
4d5ffa44be5a98eb77b2efd1d30d5577d4fd7439e7976cf0840a81b82f5971aa

SHA512
7269ace3b783a72e899bfa30b6bf95622cc8e594c4ba2cb24b875be230f15ff33c3ebbddbff49a0812bfbb33594039b4951f577f45b58a94d914a8421ac3886c

Download Submit
/usr/bin/bsd-port/conf.n
Filesize
69B

MD5
1ae27f97ab8b4399873827f81a3d3506

SHA1
362abdc0c82f3ebb606a7d64bcf823467121398e

SHA256
7b3ba64a934b20cd0faf941458f53ac6022110e734d15c8c6f8954c4a2a1dbcb

SHA512
b2f479e0c3305b4c0bc9aefe8eaef956f6cdb06ddf1f959437af606277307a082ed61fddecd7a8a4ae5998aaf7143d63204ad0fab51c5ab14cf61535429c25fc

Download Submit
/usr/bin/dpkgd/lsof
Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps
Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit