Analysis
-
max time kernel
153s -
max time network
131s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231215-en -
resource tags
-
submitted
22-12-2023 16:30
General
-
Target
f134f8f0cdf87e2f3f4d9cbcc0f86b39
-
Size
1.1MB
-
MD5
f134f8f0cdf87e2f3f4d9cbcc0f86b39
-
SHA1
584f15ff5f2188a25b8b27d96290c3550e4dffde
-
SHA256
478e45caa33dd580e1b3805d84fffd190d9cee3635137ea1d3fc4220626519a7
-
SHA512
faea0bbb90f6b0c84daf124c7db0cf1ef7fc1667e2636bab76ca06172fe930c0b6c363116338d4aa14a40b97a94e61b52f125a7ed76a2d51983078c24668c986
-
SSDEEP
24576:4vRE7caCfKGPqVEDNLFxKsfa2I+gIGYuuCol7r:4vREKfPqVE5jKsfa2RHGVo7r
Malware Config
Signatures
-
MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
-
MrBlack trojan 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Modifies init.d 1 TTPs 2 IoCs
Adds/modifies system service, likely for persistence.
-
Write file to user bin folder 1 TTPs 7 IoCs
-
Writes file to system bin folder 1 TTPs 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 15 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/f134f8f0cdf87e2f3f4d9cbcc0f86b39/tmp/f134f8f0cdf87e2f3f4d9cbcc0f86b391⤵
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /tmp/f134f8f0cdf87e2f3f4d9cbcc0f86b39 /usr/bin/bsd-port/getty"1⤵
-
/bin/cpcp -f /tmp/f134f8f0cdf87e2f3f4d9cbcc0f86b39 /usr/bin/bsd-port/getty2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c /usr/bin/bsd-port/getty1⤵
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty2⤵
- Executes dropped EXE
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /tmp/f134f8f0cdf87e2f3f4d9cbcc0f86b39 /usr/bin/libsw"1⤵
-
/bin/cpcp -f /tmp/f134f8f0cdf87e2f3f4d9cbcc0f86b39 /usr/bin/libsw2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux2⤵
-
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"1⤵
-
/bin/mkdirmkdir -p /usr/bin/dpkgd2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"1⤵
-
/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c /usr/bin/libsw1⤵
-
/usr/bin/libsw/usr/bin/libsw2⤵
- Executes dropped EXE
-
-
/bin/shsh -c "mkdir -p /bin"1⤵
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"1⤵
-
/sbin/insmodinsmod /usr/lib/xpacket.ko2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"1⤵
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ps2⤵
- Writes file to system bin folder
- Reads runtime system information
-
-
/bin/shsh -c "chmod 0755 /bin/ps"1⤵
-
/bin/chmodchmod 0755 /bin/ps2⤵
-
-
/bin/shsh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"1⤵
-
/bin/cpcp -f /usr/bin/lsof /usr/bin/dpkgd/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"1⤵
-
/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"1⤵
-
/bin/chmodchmod 0755 /usr/bin/lsof2⤵
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"1⤵
-
/sbin/insmodinsmod /usr/lib/xpacket.ko2⤵
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD56fa82b78e3a63861777b88288b0541a7
SHA1928ed9859c892c39cb447d1671b658ea59237722
SHA2564f2b815e9de1ff19bcb43294a74098b2ab6c27e60e6f1c1007f0f7dfa621af0b
SHA51295eeaa109faaab46d24ebc93d4069fa6827171fbd498a11d1ee4f7730426abd1510d2f86ab988146aeec168dbb6f0515bdcadeeaffa04e4e0d733c8580eabca4
-
Filesize
36B
MD5993cc15058142d96c3daf7852c3d5ee8
SHA10950b8b391b04dd3895ea33cd3141543ebd2525d
SHA2568171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
SHA5120c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928
-
Filesize
4B
MD5dfa92d8f817e5b08fcaafb50d03763cf
SHA1722a7e9c6dcbb04ed1fffe8d658ea03ce68f8e01
SHA256a2258ffaf9a1490a7a7a01c282b1fe03224a2952b119c3f32b1de4739407cd58
SHA5121bb31aa3c0b2b98b36fd84e77aea11ddd9861c3117e90f50627816895636534067f94ea56526c692611289f44d020dc9b44b03d2c94db07f04ae9d2e9b643d77
-
Filesize
4B
MD5c7af0926b294e47e52e46cfebe173f20
SHA1948b13c7ba369f02fc29d936c124689877023958
SHA2566d7be37d6aa3665ddca5b4c3ab26e689e4efc1c33bea69ccbaeec6ed49569558
SHA51284ff72624f10220c6960fc1d0fe9bbdd329bdc5b8eeef36d8b31d9f3b78f050f11d21b67839576982d1aa87312a1c19e075d284f7b13d28d87631735d73310e6
-
Filesize
37B
MD5e28263ca58496979f7aecabeb8d72605
SHA1375020bf6f554bf12679e3ee8dc80b8a2baa9a2d
SHA2563c3c7df18f3231fd5a76f4927e5969a6193c2935740523dfb17308f3d9680781
SHA512ffe2ec156abf0a10db5e9256dcb48edbef18f75f56cdc5f7346e01d6fbb0196c879dfcde6e5546458dc9071fd2a66be764bd9949c8d0559f8faab32994e18334
-
Filesize
1.1MB
MD5f134f8f0cdf87e2f3f4d9cbcc0f86b39
SHA1584f15ff5f2188a25b8b27d96290c3550e4dffde
SHA256478e45caa33dd580e1b3805d84fffd190d9cee3635137ea1d3fc4220626519a7
SHA512faea0bbb90f6b0c84daf124c7db0cf1ef7fc1667e2636bab76ca06172fe930c0b6c363116338d4aa14a40b97a94e61b52f125a7ed76a2d51983078c24668c986
-
Filesize
130KB
MD5558edc26f8a38fa9788220b9af8a73e7
SHA13024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA256b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
SHA512edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f