Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
128s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231222-en -
resource tags
-
submitted
22/12/2023, 17:20
General
-
Target
ff3a8d23aab424bfd9db6505b77ab05d
-
Size
1.1MB
-
MD5
ff3a8d23aab424bfd9db6505b77ab05d
-
SHA1
3228c70108778f9cd58237141652ec4ad2b01b33
-
SHA256
2c6351a60f83ef185be9991b8ebfc11af7c29c59572a0b2af2471b10392614d7
-
SHA512
9dfdab046b8d9e079115ad14c1b000ee7a9df5d7e0b8a09c5d7b4f3eb88117f79652f4a5582e69b1e9e2983564253005fdd82748e03722ccbafe06799d8fe9bd
-
SSDEEP
24576:4vRE7caCfKGPqVEDNLFxKsfawI+gIGYuuCol7r:4vREKfPqVE5jKsfawRHGVo7r
Malware Config
Signatures
-
MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
-
MrBlack trojan 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Modifies init.d 1 TTPs 2 IoCs
Adds/modifies system service, likely for persistence.
-
Write file to user bin folder 1 TTPs 7 IoCs
-
Writes file to system bin folder 1 TTPs 1 IoCs
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 15 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/ff3a8d23aab424bfd9db6505b77ab05d/tmp/ff3a8d23aab424bfd9db6505b77ab05d1⤵
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"1⤵
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt2⤵
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /tmp/ff3a8d23aab424bfd9db6505b77ab05d /usr/bin/bsd-port/getty"1⤵
-
/bin/cpcp -f /tmp/ff3a8d23aab424bfd9db6505b77ab05d /usr/bin/bsd-port/getty2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c /usr/bin/bsd-port/getty1⤵
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty2⤵
- Executes dropped EXE
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /tmp/ff3a8d23aab424bfd9db6505b77ab05d /usr/bin/.sshd"1⤵
-
/bin/cpcp -f /tmp/ff3a8d23aab424bfd9db6505b77ab05d /usr/bin/.sshd2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c /usr/bin/.sshd1⤵
-
/usr/bin/.sshd/usr/bin/.sshd2⤵
- Executes dropped EXE
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"1⤵
-
/sbin/insmodinsmod /usr/lib/xpacket.ko2⤵
- Reads runtime system information
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux2⤵
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"1⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux2⤵
-
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"1⤵
-
/bin/mkdirmkdir -p /usr/bin/dpkgd2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"1⤵
-
/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "mkdir -p /bin"1⤵
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"1⤵
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ps2⤵
- Writes file to system bin folder
- Reads runtime system information
-
-
/bin/shsh -c "chmod 0755 /bin/ps"1⤵
-
/bin/chmodchmod 0755 /bin/ps2⤵
-
-
/bin/shsh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"1⤵
-
/bin/cpcp -f /usr/bin/lsof /usr/bin/dpkgd/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"1⤵
-
/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
-
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"1⤵
-
/bin/chmodchmod 0755 /usr/bin/lsof2⤵
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"1⤵
-
/sbin/insmodinsmod /usr/lib/xpacket.ko2⤵
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD55bfd864765db4e2b6882f94a0cdda2d6
SHA14256f5f0bc3614d1beb7d446a3df23b67f1d0db9
SHA256ba3032a9ce252d30bd5c8bf30d927a38bcb0573867b42d87038b6bfd12580d52
SHA512633011ab2438f2bd4a5fa68662ec4a03e288dfff3c674a10ed0b935080e9e39f1fdcf5b880ed13db5f593afba2d855f3f4e347f5843680bb2406dd8f012c91d8
-
Filesize
36B
MD5993cc15058142d96c3daf7852c3d5ee8
SHA10950b8b391b04dd3895ea33cd3141543ebd2525d
SHA2568171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
SHA5120c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928
-
Filesize
4B
MD55129a5ddcd0dcd755232baa04c231698
SHA1b2a3625de074749ed626d2c2fdf5342d7757a850
SHA256e52522a505f68250e81747aa5386c5c60196c1680f1c89762ab1ab0fbaae39b8
SHA51227f36a56ba7f81569a7edcada4b457648cef41168a85cadf11c6e649295b110569e060047c624376a3dd8372edf153ae15c954cce7e308e8f826884a707d12c9
-
Filesize
4B
MD5efb76cff97aaf057654ef2f38cd77d73
SHA1b26ad862c55257cb44c33db294f559908abaaa39
SHA256e6c3b6f798b0e8d63406a281cf31ed72a005f9aaba8970ba3d008f2254001146
SHA512532a398d6f754d66c37bf68c6eee96c46e7448062e4bd13c2fde21257bf282734c3f624431acf48ee35af53a94e216861c2a6928b95f2d72d61c3e3661b3ffb1
-
Filesize
37B
MD58463c17e142a2f74d94f9d93e512276e
SHA1d413889aad0457c20bb8dde856ce40158cd10122
SHA25645b052fcef08c2fca65644137922633ede8af0888a324d709ece974fc8b3b533
SHA5128aa1b73c06aeb377e425cc41eea3665a629347c458f624a9636df800996fa2295a252a8184161ade23daca5b533107f0ede079a7fbd198448702549c41e7b398
-
Filesize
1.1MB
MD5ff3a8d23aab424bfd9db6505b77ab05d
SHA13228c70108778f9cd58237141652ec4ad2b01b33
SHA2562c6351a60f83ef185be9991b8ebfc11af7c29c59572a0b2af2471b10392614d7
SHA5129dfdab046b8d9e079115ad14c1b000ee7a9df5d7e0b8a09c5d7b4f3eb88117f79652f4a5582e69b1e9e2983564253005fdd82748e03722ccbafe06799d8fe9bd
-
Filesize
159KB
MD5e093dc78225e2a0a25e3b137c1c1e442
SHA1c29497cfaae729eb576875e4fdfa400640ab16be
SHA2561190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
SHA512fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
-
Filesize
130KB
MD5558edc26f8a38fa9788220b9af8a73e7
SHA13024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA256b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
SHA512edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f