Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
131s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
22/12/2023, 15:18
Behavioral task
behavioral1
Sample
d6e5833b5fd732ac2ba017b1a6d34d77
Resource
ubuntu1804-amd64-20231215-en
General
-
Target
d6e5833b5fd732ac2ba017b1a6d34d77
-
Size
1.2MB
-
MD5
d6e5833b5fd732ac2ba017b1a6d34d77
-
SHA1
77a31f0c1fdc7548c20e034c1761515a47a56a79
-
SHA256
856452857b500cca80879789377b60a6721cfe065f1f254a929d06f731eccca0
-
SHA512
1109c33635df4c76b3f56cad57fabfd5994d63e88f69533afe1aaa61d80a568dcdcfddda9cf0e763280427cadddaf2bc62d42162d0bcc2c7ba2a5cf1f4cfcf8a
-
SSDEEP
24576:e845rGHu6gVJKG75oFpA0VWIX4h2y1q2rJp0:745vRVJKGtSA0VWIo4u9p0
Malware Config
Signatures
-
MrBlack trojan 1 IoCs
resource yara_rule behavioral1/files/fstream-4.dat family_mrblack -
Executes dropped EXE 2 IoCs
ioc pid Process /usr/bin/bsd-port/getty 1586 getty /usr/bin/.sshd 1597 .sshd -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc File opened for reading /proc/cpuinfo -
description ioc File opened for modification /etc/init.d/DbSecuritySpt -
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc File opened for reading /proc/net/route -
Write file to user bin folder 1 TTPs 4 IoCs
description ioc Process File opened for modification /usr/bin/bsd-port/getty.lock Process not Found File opened for modification /usr/bin/bsd-port/udevd.lock Process not Found File opened for modification /usr/bin/bsd-port/getty cp File opened for modification /usr/bin/.sshd cp -
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/dev File opened for reading /proc/net/route File opened for reading /proc/net/arp -
Reads runtime system information 9 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/filesystems mkdir File opened for reading /proc/stat Process not Found File opened for reading /proc/filesystems cp File opened for reading /proc/meminfo Process not Found File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir -
Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
description ioc File opened for modification /tmp/moni.lod File opened for modification /tmp/bill.lock File opened for modification /tmp/gates.lod File opened for modification /tmp/notify.file File opened for modification /tmp/conf.n
Processes
-
/tmp/d6e5833b5fd732ac2ba017b1a6d34d77/tmp/d6e5833b5fd732ac2ba017b1a6d34d771⤵PID:1563
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"1⤵PID:1568
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt2⤵PID:1569
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"1⤵PID:1570
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt2⤵PID:1571
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"1⤵PID:1572
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt2⤵PID:1573
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"1⤵PID:1574
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt2⤵PID:1575
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"1⤵PID:1576
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt2⤵PID:1577
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵PID:1578
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
PID:1579
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵PID:1580
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
PID:1581
-
-
/bin/shsh -c "cp -f /tmp/d6e5833b5fd732ac2ba017b1a6d34d77 /usr/bin/bsd-port/getty"1⤵PID:1582
-
/bin/cpcp -f /tmp/d6e5833b5fd732ac2ba017b1a6d34d77 /usr/bin/bsd-port/getty2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1583
-
-
/bin/shsh -c /usr/bin/bsd-port/getty1⤵PID:1585
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty2⤵
- Executes dropped EXE
PID:1586
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1589
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1590
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1591
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1592
-
-
/bin/shsh -c "cp -f /tmp/d6e5833b5fd732ac2ba017b1a6d34d77 /usr/bin/.sshd"1⤵PID:1593
-
/bin/cpcp -f /tmp/d6e5833b5fd732ac2ba017b1a6d34d77 /usr/bin/.sshd2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1594
-
-
/bin/shsh -c /usr/bin/.sshd1⤵PID:1596
-
/usr/bin/.sshd/usr/bin/.sshd2⤵
- Executes dropped EXE
PID:1597
-
-
/bin/shsh -c "insmod /tmp/xpacket.ko"1⤵PID:1600
-
/sbin/insmodinsmod /tmp/xpacket.ko2⤵
- Reads runtime system information
PID:1601
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD5facf9f743b083008a894eee7baa16469
SHA1fe286d02f80118de47f2226c2fce9f7be0bc04f0
SHA2562163909115c0f6f1e638bd2c2279387cbe37cc327150a7b5cddfde3d1cd4ef0e
SHA5127bd3d1d347d68f23d612a3ec7a1d2f4094874162441bae20122876ea980bbb76a3c46d5d2e393975ea0659fb2b58046a311d7660f226482a57a74e9ffd9b0f36
-
Filesize
1.2MB
MD5d6e5833b5fd732ac2ba017b1a6d34d77
SHA177a31f0c1fdc7548c20e034c1761515a47a56a79
SHA256856452857b500cca80879789377b60a6721cfe065f1f254a929d06f731eccca0
SHA5121109c33635df4c76b3f56cad57fabfd5994d63e88f69533afe1aaa61d80a568dcdcfddda9cf0e763280427cadddaf2bc62d42162d0bcc2c7ba2a5cf1f4cfcf8a