mrblack | 7fd819ff6a69b045b0d7eb9900987dff73792a68acaa45cb0e2ef9298c5bba54

General

Target

7f0c9c24f2bd4145e923fe65bcdfd49c.elf
Size

1.2MB
MD5

7f0c9c24f2bd4145e923fe65bcdfd49c
SHA1

ee482d0f762f102a86bd500c16b2586d3d20795c
SHA256

7fd819ff6a69b045b0d7eb9900987dff73792a68acaa45cb0e2ef9298c5bba54
SHA512

33a3ce0ee73f7ee07cb39955a8c29649578b4e38dbcd9d442dff725b97896bda1ba73bd816955f48c562925345c8790ec976a0b4e5a6cf1f93b2f2e91199b186
SSDEEP

24576:e845rGHu6gVJKG75oFpA0VWeX462y1q2rJp0:745vRVJKGtSA0VWeo5u9p0

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 2 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack
behavioral1/files/fstream-6.dat	family_mrblack

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	1563	getty
/usr/bin/.sshd	1578	.sshd

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc
File opened for reading	/proc/cpuinfo

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc
File opened for modification	/etc/init.d/DbSecuritySpt
File opened for modification	/etc/init.d/selinux

Write file to user bin folder 1 TTPs 8 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/udevd.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/getty	cp

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/ss	cp
File opened for modification	/bin/ps	cp

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc
File opened for reading	/proc/net/dev

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/meminfo	Process not Found
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	Process not Found
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/gates.lod
File opened for modification	/tmp/notify.file
File opened for modification	/tmp/moni.lod
File opened for modification	/tmp/bill.lock

/tmp/7f0c9c24f2bd4145e923fe65bcdfd49c.elf
/tmp/7f0c9c24f2bd4145e923fe65bcdfd49c.elf
1⤵
PID:1540

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
1⤵
PID:1545
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:1546

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
1⤵
PID:1547
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:1548

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
1⤵
PID:1549
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:1550

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
1⤵
PID:1551
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:1552

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
1⤵
PID:1553
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:1554

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1555
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1556

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1557
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1558

/bin/sh
sh -c "cp -f /tmp/7f0c9c24f2bd4145e923fe65bcdfd49c.elf /usr/bin/bsd-port/getty"
1⤵
PID:1559
- /bin/cp
  cp -f /tmp/7f0c9c24f2bd4145e923fe65bcdfd49c.elf /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1560

/bin/sh
sh -c /usr/bin/bsd-port/getty
1⤵
PID:1562
- /usr/bin/bsd-port/getty
  /usr/bin/bsd-port/getty
  2⤵
  - Executes dropped EXE
  PID:1563

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1565
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1566

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1567
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1568

/bin/sh
sh -c "cp -f /tmp/7f0c9c24f2bd4145e923fe65bcdfd49c.elf /usr/bin/.sshd"
1⤵
PID:1569
- /bin/cp
  cp -f /tmp/7f0c9c24f2bd4145e923fe65bcdfd49c.elf /usr/bin/.sshd
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1570

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
1⤵
PID:1571
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
  2⤵
  PID:1572

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
1⤵
PID:1573
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
  2⤵
  PID:1574

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
1⤵
PID:1575
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
  2⤵
  PID:1579

/bin/sh
sh -c /usr/bin/.sshd
1⤵
PID:1577
- /usr/bin/.sshd
  /usr/bin/.sshd
  2⤵
  - Executes dropped EXE
  PID:1578

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
1⤵
PID:1580
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
  2⤵
  PID:1581

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
1⤵
PID:1582
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
  2⤵
  PID:1583

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
1⤵
PID:1584
- /bin/mkdir
  mkdir -p /usr/bin/dpkgd
  2⤵
  - Reads runtime system information
  PID:1585

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
1⤵
PID:1586
- /bin/cp
  cp -f /bin/ps /usr/bin/dpkgd/ps
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1587

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1588
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1589

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1590
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1591

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
1⤵
PID:1592
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ps
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1593

/bin/sh
sh -c "chmod 0755 /bin/ps"
1⤵
PID:1596
- /bin/chmod
  chmod 0755 /bin/ps
  2⤵
  PID:1597

/bin/sh
sh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"
1⤵
PID:1598
- /bin/cp
  cp -f /bin/ss /usr/bin/dpkgd/ss
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1599

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1600
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1601

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1602
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1603

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"
1⤵
PID:1604
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ss
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1605

/bin/sh
sh -c "chmod 0755 /bin/ss"
1⤵
PID:1606
- /bin/chmod
  chmod 0755 /bin/ss
  2⤵
  PID:1607

/bin/sh
sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
1⤵
PID:1608
- /bin/cp
  cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1609

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1610
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1611

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1612
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1613

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
1⤵
PID:1614
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1615

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
1⤵
PID:1616
- /bin/chmod
  chmod 0755 /usr/bin/lsof
  2⤵
  PID:1617

/bin/sh
sh -c "insmod /tmp/xpacket.ko"
1⤵
PID:1621
- /sbin/insmod
  insmod /tmp/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1622

/bin/sh
sh -c "insmod /usr/bin/bsd-port/xpacket.ko"
1⤵
PID:1624
- /sbin/insmod
  insmod /usr/bin/bsd-port/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1625

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Hijack Execution Flow

2

T1574

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Hijack Execution Flow

2

T1574

Defense Evasion

Hijack Execution Flow

2

T1574

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/moni.lod

Filesize
4B

MD5
0ebcc77dc72360d0eb8e9504c78d38bd

SHA1
8b583aa0ac7f15508192f2ea1c56b9a07eb48e38

SHA256
8698616a6419549cd9c035d5e250c81c6cefff11ff31c9602bf2ff5aa3e06b7f

SHA512
18bc49d42d4b488f1264cf1f0fb6f914aa29d320e8721f75da80e9324a63c027670f82f6a0549837caac67f83e83dd67480305c079d65a380b54ff013ca11727

Download Submit
/tmp/notify.file

Filesize
41B

MD5
03985dd45e5e59a912d1c7525301c086

SHA1
e40e85cf3e6cbfaae02f09d33b2f2adf3d4bdaf3

SHA256
7bd3503ea69bdba1bf12fe1cabb0c45a503e6812c5b58e6d1a2dc6e89f0faa24

SHA512
3028144bbb5a1fb43182c4cbec2881d5b3f4633c55456399150d926a06b2cd0760a8e4577269595b8d976dd9bb6638b57b3ce976205a9e18d925fe5349b71be0

Download Submit
/usr/bin/.sshd

Filesize
794KB

MD5
55eb8b92310f556b30a4b6f6848d8c3b

SHA1
9041643fda66979fabaeb31e0f6f5bb8f6d1ad07

SHA256
185c80c0c908747a65165f0929f13ad9450d91b33b01c24ac00e0658fc1305e6

SHA512
3bbe9585dc9cbeb6022a73c0025824e6536597334e292cc61c15f0332be59e3cf04f37042377d8323144fbbd0a6186082a2ed531945a770b60b2bcadc1a709c3

Download Submit
/usr/bin/bsd-port/getty

Filesize
1.2MB

MD5
7f0c9c24f2bd4145e923fe65bcdfd49c

SHA1
ee482d0f762f102a86bd500c16b2586d3d20795c

SHA256
7fd819ff6a69b045b0d7eb9900987dff73792a68acaa45cb0e2ef9298c5bba54

SHA512
33a3ce0ee73f7ee07cb39955a8c29649578b4e38dbcd9d442dff725b97896bda1ba73bd816955f48c562925345c8790ec976a0b4e5a6cf1f93b2f2e91199b186

Download Submit
/usr/bin/dpkgd/lsof

Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps

Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit
/usr/bin/dpkgd/ss

Filesize
136KB

MD5
1dc929b5f2cd12fe6a2fe71140d2a9e3

SHA1
f9995a92bb201b1b7738a39a38570ef0c40b52d2

SHA256
418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38

SHA512
fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads