General

  • Target

    f55b3b99e0b783b60e27202f1c839ab1

  • Size

    1.5MB

  • Sample

    231222-t5d2habhb9

  • MD5

    f55b3b99e0b783b60e27202f1c839ab1

  • SHA1

    62a9eea529000e27e7524c1a87ee6379fa090d6d

  • SHA256

    2cf26b87030f07a237b9a714bf4f0fb0cc0a20d88a39f2ffba8e516ff6763dd9

  • SHA512

    6fb80e752eac21961c00accce0239cd720f11b7fca776ec068625314594c868bd3fd126a197560a176f1906b2b5e8dbb4a720a44badfb5747b36e1870be5aaf9

  • SSDEEP

    24576:GA46TrzJBisiOvhlOHdSbQmHyJgf/kgX0Exb2cyaGpIoiM1nnLmYXqSYKKZdTrnD:zRNi6OHdSbQoyJyXpxb2PaGpXiM1nLmB

Malware Config

Targets

    • Target

      f55b3b99e0b783b60e27202f1c839ab1

    • Size

      1.5MB

    • MD5

      f55b3b99e0b783b60e27202f1c839ab1

    • SHA1

      62a9eea529000e27e7524c1a87ee6379fa090d6d

    • SHA256

      2cf26b87030f07a237b9a714bf4f0fb0cc0a20d88a39f2ffba8e516ff6763dd9

    • SHA512

      6fb80e752eac21961c00accce0239cd720f11b7fca776ec068625314594c868bd3fd126a197560a176f1906b2b5e8dbb4a720a44badfb5747b36e1870be5aaf9

    • SSDEEP

      24576:GA46TrzJBisiOvhlOHdSbQmHyJgf/kgX0Exb2cyaGpIoiM1nnLmYXqSYKKZdTrnD:zRNi6OHdSbQoyJyXpxb2PaGpXiM1nLmB

    • MrBlack Trojan

      IoT botnet which infects routers to be used for DDoS attacks.

    • MrBlack trojan

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

    • Write file to user bin folder

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Hijack Execution Flow

1
T1574

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Hijack Execution Flow

1
T1574

Defense Evasion

Hijack Execution Flow

1
T1574

Tasks