mrblack | 7fd819ff6a69b045b0d7eb9900987dff73792a68acaa45cb0e2ef9298c5bba54

Analysis

max time kernel
154s
max time network
140s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231215-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
29-01-2024 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f0c9c24f2bd4145e923fe65bcdfd49c
Size

1.2MB
MD5

7f0c9c24f2bd4145e923fe65bcdfd49c
SHA1

ee482d0f762f102a86bd500c16b2586d3d20795c
SHA256

7fd819ff6a69b045b0d7eb9900987dff73792a68acaa45cb0e2ef9298c5bba54
SHA512

33a3ce0ee73f7ee07cb39955a8c29649578b4e38dbcd9d442dff725b97896bda1ba73bd816955f48c562925345c8790ec976a0b4e5a6cf1f93b2f2e91199b186
SSDEEP

24576:e845rGHu6gVJKG75oFpA0VWeX462y1q2rJp0:745vRVJKGtSA0VWeo5u9p0

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 2 IoCs

Processes:

resource	yara_rule
/usr/bin/bsd-port/getty	family_mrblack
/usr/bin/.sshd	family_mrblack

Executes dropped EXE 2 IoCs

Processes:

getty.sshd

ioc pid process

/usr/bin/bsd-port/getty 1553 getty
/usr/bin/.sshd 1570 .sshd
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

description ioc

File opened for reading /proc/cpuinfo
Modifies init.d 1 TTPs 2 IoCs
Adds/modifies system service, likely for persistence.
persistence

Boot or Logon Autostart Execution
T1547

Processes:

description ioc

File opened for modification /etc/init.d/DbSecuritySpt
File opened for modification /etc/init.d/selinux

ioc	pid	process
/usr/bin/bsd-port/getty	1553	getty
/usr/bin/.sshd	1570	.sshd

description	ioc
File opened for reading	/proc/cpuinfo

description	ioc
File opened for modification	/etc/init.d/DbSecuritySpt
File opened for modification	/etc/init.d/selinux

Write file to user bin folder 1 TTPs 8 IoCs

Hijack Execution Flow

T1574

Processes:

cpcpcpcpcpcp

description	ioc	process
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/getty.lock
File opened for modification	/usr/bin/bsd-port/udevd.lock
File opened for modification	/usr/bin/bsd-port/getty	cp

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow
T1574

Processes:

cpcp

description ioc process

File opened for modification /bin/ss cp
File opened for modification /bin/ps cp
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

description ioc

File opened for reading /proc/net/dev

description	ioc	process
File opened for modification	/bin/ss	cp
File opened for modification	/bin/ps	cp

description	ioc
File opened for reading	/proc/net/dev

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

Processes:

cpmkdircpmkdirmkdircpmkdircpmkdircpinsmodinsmodcpcpmkdirmkdircpmkdirmkdirmkdirmkdir

description	ioc	process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat
File opened for reading	/proc/meminfo
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

Processes:

description	ioc
File opened for modification	/tmp/moni.lod
File opened for modification	/tmp/bill.lock
File opened for modification	/tmp/gates.lod
File opened for modification	/tmp/notify.file

/tmp/7f0c9c24f2bd4145e923fe65bcdfd49c
/tmp/7f0c9c24f2bd4145e923fe65bcdfd49c
1⤵
PID:1529

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
1⤵
PID:1535

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
2⤵
PID:1536

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
1⤵
PID:1537

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
2⤵
PID:1538

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
1⤵
PID:1539

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
2⤵
PID:1540

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
1⤵
PID:1541

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
2⤵
PID:1542

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
1⤵
PID:1543

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
2⤵
PID:1544

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1545

/bin/mkdir
mkdir -p /usr/bin/bsd-port
2⤵
- Reads runtime system information
PID:1546

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1547

/bin/mkdir
mkdir -p /usr/bin/bsd-port
2⤵
- Reads runtime system information
PID:1548

/bin/sh
sh -c "cp -f /tmp/7f0c9c24f2bd4145e923fe65bcdfd49c /usr/bin/bsd-port/getty"
1⤵
PID:1549

/bin/cp
cp -f /tmp/7f0c9c24f2bd4145e923fe65bcdfd49c /usr/bin/bsd-port/getty
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1550

/bin/sh
sh -c /usr/bin/bsd-port/getty
1⤵
PID:1552

/usr/bin/bsd-port/getty
/usr/bin/bsd-port/getty
2⤵
- Executes dropped EXE
PID:1553

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1555

/bin/mkdir
mkdir -p /usr/bin
2⤵
- Reads runtime system information
PID:1556

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1557

/bin/mkdir
mkdir -p /usr/bin
2⤵
- Reads runtime system information
PID:1558

/bin/sh
sh -c "cp -f /tmp/7f0c9c24f2bd4145e923fe65bcdfd49c /usr/bin/.sshd"
1⤵
PID:1559

/bin/cp
cp -f /tmp/7f0c9c24f2bd4145e923fe65bcdfd49c /usr/bin/.sshd
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1560

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
1⤵
PID:1561

/bin/ln
ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
2⤵
PID:1562

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
1⤵
PID:1563

/bin/ln
ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
2⤵
PID:1564

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
1⤵
PID:1565

/bin/ln
ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
2⤵
PID:1566

/bin/sh
sh -c /usr/bin/.sshd
1⤵
PID:1569

/usr/bin/.sshd
/usr/bin/.sshd
2⤵
- Executes dropped EXE
PID:1570

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
1⤵
PID:1567

/bin/ln
ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
2⤵
PID:1571

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
1⤵
PID:1572

/bin/ln
ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
2⤵
PID:1573

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
1⤵
PID:1574

/bin/mkdir
mkdir -p /usr/bin/dpkgd
2⤵
- Reads runtime system information
PID:1575

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
1⤵
PID:1576

/bin/cp
cp -f /bin/ps /usr/bin/dpkgd/ps
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1577

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1578

/bin/mkdir
mkdir -p /bin
2⤵
- Reads runtime system information
PID:1579

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1580

/bin/mkdir
mkdir -p /bin
2⤵
- Reads runtime system information
PID:1581

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
1⤵
PID:1582

/bin/cp
cp -f /usr/bin/bsd-port/getty /bin/ps
2⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1583

/bin/sh
sh -c "chmod 0755 /bin/ps"
1⤵
PID:1584

/bin/chmod
chmod 0755 /bin/ps
2⤵
PID:1585

/bin/sh
sh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"
1⤵
PID:1586

/bin/cp
cp -f /bin/ss /usr/bin/dpkgd/ss
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1587

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1588

/bin/mkdir
mkdir -p /bin
2⤵
- Reads runtime system information
PID:1589

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1590

/bin/mkdir
mkdir -p /bin
2⤵
- Reads runtime system information
PID:1591

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"
1⤵
PID:1592

/bin/cp
cp -f /usr/bin/bsd-port/getty /bin/ss
2⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1593

/bin/sh
sh -c "chmod 0755 /bin/ss"
1⤵
PID:1594

/bin/chmod
chmod 0755 /bin/ss
2⤵
PID:1595

/bin/sh
sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
1⤵
PID:1596

/bin/cp
cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1597

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1598

/bin/mkdir
mkdir -p /usr/bin
2⤵
- Reads runtime system information
PID:1599

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1600

/bin/mkdir
mkdir -p /usr/bin
2⤵
- Reads runtime system information
PID:1601

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
1⤵
PID:1602

/bin/cp
cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1603

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
1⤵
PID:1604

/bin/chmod
chmod 0755 /usr/bin/lsof
2⤵
PID:1605

/bin/sh
sh -c "insmod /usr/bin/bsd-port/xpacket.ko"
1⤵
PID:1608

/sbin/insmod
insmod /usr/bin/bsd-port/xpacket.ko
2⤵
- Reads runtime system information
PID:1610

/bin/sh
sh -c "insmod /tmp/xpacket.ko"
1⤵
PID:1609

/sbin/insmod
insmod /tmp/xpacket.ko
2⤵
- Reads runtime system information
PID:1611

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Hijack Execution Flow

T1574

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt
Filesize
50B

MD5
ae8f32712d7c1a2e7764ea5ff6558743

SHA1
180f1d192073e9666316660a54e86a5c0c077ff1

SHA256
5075f90b9cd82dbe868164b4b01805510a986a23a8132516fcac6f48e4d50a7c

SHA512
19198a18a1af98ad38b1f3d1415918344284a740bc42b39ea91fc82fb7640e1f36d725fd4bfc11bddb6d49863d2ef702ebc13150b24437b2ce75abef2b3159d6

Download Submit
/etc/init.d/selinux
Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/gates.lod
Filesize
4B

MD5
cb8acb1dc9821bf74e6ca9068032d623

SHA1
0ad54e429b2b6238550f24701541130b978e4640

SHA256
8ff9538e65e6781d654b811f88161d12455935ffb8f470815063b6ab6cb7fdff

SHA512
355051ba1d636582e623824587c9d5c6e6cc4c98dc830c26b212d61d0d009b91ad062aa99c7c2a3982a3b34091c49e412d7bfaf6d57c80794e7b3c31801dd964

Download Submit
/tmp/moni.lod
Filesize
4B

MD5
495dabfd0ca768a3c3abd672079f48b6

SHA1
2121f1b445f6128e8547c4eca7101700248d4c1a

SHA256
25d114d44f1ee498521f51cd12e524e8fd6e67c82a9d21fc29c0bbc7fff457c4

SHA512
a42f803d3332cab5bf8d9da63cf705b7418509a6dc5b2e357fabf398fc29cf6fbbcf83c790776d440467968e7c14585aed16a9f61a4b3b590664363767fb8414

Download Submit
/tmp/notify.file
Filesize
37B

MD5
76b38b7b44d81c861c723be729a31423

SHA1
1ce0c29fa01b1e8420a5d625d72fae3906f35411

SHA256
1e534188847c57384c26d7c5b1e28b680ed3ade584c3c221b63344643716ef5c

SHA512
468bb95f013396bc5fe33c6e881ec6eeecda62334259956c53b152e2e5e7b882d07559d21a3cba5c2a5a6bc584481d9d19810d35036d1aaebabc34c22f32e3af

Download Submit
/usr/bin/.sshd
Filesize
1.1MB

MD5
3c207c8822386f2da039af4ea99d2a12

SHA1
1806d34aa550ac027071f08eaa09051e564a2e5c

SHA256
42be4f23ba079b6d00236205a4e6adde6b8f23c2952f2112b583898cb5297a43

SHA512
e38fcc4bf17b613ca4bfd99f077fb7d57955c6a73b0a96760fe2fe694e64c4d49673c2aedd1fd86eca09924446aff32db628ba8868f68fb75e931d1cb901eab6

Download Submit
/usr/bin/bsd-port/getty
Filesize
1.2MB

MD5
7f0c9c24f2bd4145e923fe65bcdfd49c

SHA1
ee482d0f762f102a86bd500c16b2586d3d20795c

SHA256
7fd819ff6a69b045b0d7eb9900987dff73792a68acaa45cb0e2ef9298c5bba54

SHA512
33a3ce0ee73f7ee07cb39955a8c29649578b4e38dbcd9d442dff725b97896bda1ba73bd816955f48c562925345c8790ec976a0b4e5a6cf1f93b2f2e91199b186

Download Submit
/usr/bin/dpkgd/lsof
Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps
Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit
/usr/bin/dpkgd/ss
Filesize
136KB

MD5
1dc929b5f2cd12fe6a2fe71140d2a9e3

SHA1
f9995a92bb201b1b7738a39a38570ef0c40b52d2

SHA256
418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38

SHA512
fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373

Download Submit