Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
128s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20231222-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20231222-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
22/12/2023, 17:20
Behavioral task
behavioral1
Sample
ff3a8d23aab424bfd9db6505b77ab05d
Resource
ubuntu1804-amd64-20231222-en
General
-
Target
ff3a8d23aab424bfd9db6505b77ab05d
-
Size
1.1MB
-
MD5
ff3a8d23aab424bfd9db6505b77ab05d
-
SHA1
3228c70108778f9cd58237141652ec4ad2b01b33
-
SHA256
2c6351a60f83ef185be9991b8ebfc11af7c29c59572a0b2af2471b10392614d7
-
SHA512
9dfdab046b8d9e079115ad14c1b000ee7a9df5d7e0b8a09c5d7b4f3eb88117f79652f4a5582e69b1e9e2983564253005fdd82748e03722ccbafe06799d8fe9bd
-
SSDEEP
24576:4vRE7caCfKGPqVEDNLFxKsfawI+gIGYuuCol7r:4vREKfPqVE5jKsfawRHGVo7r
Malware Config
Signatures
-
MrBlack trojan 1 IoCs
resource yara_rule behavioral1/files/fstream-4.dat family_mrblack -
Executes dropped EXE 2 IoCs
ioc pid Process /usr/bin/bsd-port/getty 1619 getty /usr/bin/.sshd 1627 .sshd -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc File opened for reading /proc/cpuinfo -
description ioc File opened for modification /etc/init.d/DbSecuritySpt File opened for modification /etc/init.d/selinux -
Write file to user bin folder 1 TTPs 7 IoCs
description ioc Process File opened for modification /usr/bin/bsd-port/getty.lock Process not Found File opened for modification /usr/bin/bsd-port/udevd.lock Process not Found File opened for modification /usr/bin/bsd-port/getty cp File opened for modification /usr/bin/.sshd cp File opened for modification /usr/bin/dpkgd/ps cp File opened for modification /usr/bin/dpkgd/lsof cp File opened for modification /usr/bin/lsof cp -
Writes file to system bin folder 1 TTPs 1 IoCs
description ioc Process File opened for modification /bin/ps cp -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/dev -
Reads runtime system information 15 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/meminfo Process not Found File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/stat Process not Found File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp -
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
description ioc File opened for modification /tmp/moni.lock File opened for modification /tmp/bill.lock File opened for modification /tmp/gates.lock File opened for modification /tmp/notify.file
Processes
-
/tmp/ff3a8d23aab424bfd9db6505b77ab05d/tmp/ff3a8d23aab424bfd9db6505b77ab05d1⤵PID:1590
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"1⤵PID:1603
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt2⤵PID:1604
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"1⤵PID:1605
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt2⤵PID:1606
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"1⤵PID:1607
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt2⤵PID:1608
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"1⤵PID:1609
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt2⤵PID:1610
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"1⤵PID:1611
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt2⤵PID:1612
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵PID:1613
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
PID:1614
-
-
/bin/shsh -c "cp -f /tmp/ff3a8d23aab424bfd9db6505b77ab05d /usr/bin/bsd-port/getty"1⤵PID:1615
-
/bin/cpcp -f /tmp/ff3a8d23aab424bfd9db6505b77ab05d /usr/bin/bsd-port/getty2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1616
-
-
/bin/shsh -c /usr/bin/bsd-port/getty1⤵PID:1618
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty2⤵
- Executes dropped EXE
PID:1619
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1621
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1622
-
-
/bin/shsh -c "cp -f /tmp/ff3a8d23aab424bfd9db6505b77ab05d /usr/bin/.sshd"1⤵PID:1623
-
/bin/cpcp -f /tmp/ff3a8d23aab424bfd9db6505b77ab05d /usr/bin/.sshd2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1624
-
-
/bin/shsh -c /usr/bin/.sshd1⤵PID:1626
-
/usr/bin/.sshd/usr/bin/.sshd2⤵
- Executes dropped EXE
PID:1627
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"1⤵PID:1629
-
/sbin/insmodinsmod /usr/lib/xpacket.ko2⤵
- Reads runtime system information
PID:1630
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"1⤵PID:1634
-
/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux2⤵PID:1635
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"1⤵PID:1636
-
/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux2⤵PID:1637
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"1⤵PID:1639
-
/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux2⤵PID:1641
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"1⤵PID:1643
-
/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux2⤵PID:1644
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"1⤵PID:1646
-
/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux2⤵PID:1647
-
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"1⤵PID:1648
-
/bin/mkdirmkdir -p /usr/bin/dpkgd2⤵
- Reads runtime system information
PID:1649
-
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"1⤵PID:1650
-
/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1651
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1652
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1653
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"1⤵PID:1654
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ps2⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1655
-
-
/bin/shsh -c "chmod 0755 /bin/ps"1⤵PID:1656
-
/bin/chmodchmod 0755 /bin/ps2⤵PID:1657
-
-
/bin/shsh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"1⤵PID:1658
-
/bin/cpcp -f /usr/bin/lsof /usr/bin/dpkgd/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1659
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1660
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1661
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"1⤵PID:1662
-
/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1663
-
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"1⤵PID:1665
-
/bin/chmodchmod 0755 /usr/bin/lsof2⤵PID:1666
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"1⤵PID:1667
-
/sbin/insmodinsmod /usr/lib/xpacket.ko2⤵
- Reads runtime system information
PID:1668
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD55bfd864765db4e2b6882f94a0cdda2d6
SHA14256f5f0bc3614d1beb7d446a3df23b67f1d0db9
SHA256ba3032a9ce252d30bd5c8bf30d927a38bcb0573867b42d87038b6bfd12580d52
SHA512633011ab2438f2bd4a5fa68662ec4a03e288dfff3c674a10ed0b935080e9e39f1fdcf5b880ed13db5f593afba2d855f3f4e347f5843680bb2406dd8f012c91d8
-
Filesize
36B
MD5993cc15058142d96c3daf7852c3d5ee8
SHA10950b8b391b04dd3895ea33cd3141543ebd2525d
SHA2568171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
SHA5120c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928
-
Filesize
4B
MD55129a5ddcd0dcd755232baa04c231698
SHA1b2a3625de074749ed626d2c2fdf5342d7757a850
SHA256e52522a505f68250e81747aa5386c5c60196c1680f1c89762ab1ab0fbaae39b8
SHA51227f36a56ba7f81569a7edcada4b457648cef41168a85cadf11c6e649295b110569e060047c624376a3dd8372edf153ae15c954cce7e308e8f826884a707d12c9
-
Filesize
4B
MD5efb76cff97aaf057654ef2f38cd77d73
SHA1b26ad862c55257cb44c33db294f559908abaaa39
SHA256e6c3b6f798b0e8d63406a281cf31ed72a005f9aaba8970ba3d008f2254001146
SHA512532a398d6f754d66c37bf68c6eee96c46e7448062e4bd13c2fde21257bf282734c3f624431acf48ee35af53a94e216861c2a6928b95f2d72d61c3e3661b3ffb1
-
Filesize
37B
MD58463c17e142a2f74d94f9d93e512276e
SHA1d413889aad0457c20bb8dde856ce40158cd10122
SHA25645b052fcef08c2fca65644137922633ede8af0888a324d709ece974fc8b3b533
SHA5128aa1b73c06aeb377e425cc41eea3665a629347c458f624a9636df800996fa2295a252a8184161ade23daca5b533107f0ede079a7fbd198448702549c41e7b398
-
Filesize
1.1MB
MD5ff3a8d23aab424bfd9db6505b77ab05d
SHA13228c70108778f9cd58237141652ec4ad2b01b33
SHA2562c6351a60f83ef185be9991b8ebfc11af7c29c59572a0b2af2471b10392614d7
SHA5129dfdab046b8d9e079115ad14c1b000ee7a9df5d7e0b8a09c5d7b4f3eb88117f79652f4a5582e69b1e9e2983564253005fdd82748e03722ccbafe06799d8fe9bd
-
Filesize
159KB
MD5e093dc78225e2a0a25e3b137c1c1e442
SHA1c29497cfaae729eb576875e4fdfa400640ab16be
SHA2561190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
SHA512fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
-
Filesize
130KB
MD5558edc26f8a38fa9788220b9af8a73e7
SHA13024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA256b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
SHA512edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f