mrblack | cfaaf70ca32d5ff133378cc0cfdc0cd5f27d91abf6853404df57208a8a7d3de4

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231222-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231222-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
19-02-2024 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abc66fbc294358fb5ca8c4dd2f3e42cf.elf
Size

1.2MB
MD5

abc66fbc294358fb5ca8c4dd2f3e42cf
SHA1

a89a5999f2f6c37e1316f748767113b9b211cb3e
SHA256

cfaaf70ca32d5ff133378cc0cfdc0cd5f27d91abf6853404df57208a8a7d3de4
SHA512

ac1e4b3e8190625e5a54ae078081b61e39f717c22392441f67590167f015598ba36c4a186889d715ca52cd727d2e140e98504bc70c203718e754a20e4c90f5af
SSDEEP

24576:e845rGHu6gVJKG75oFpA0VWeX4g2y1q2rJp0:745vRVJKGtSA0VWeoXu9p0

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 2 IoCs

Processes:

resource	yara_rule
/usr/bin/bsd-port/getty	family_mrblack
/usr/bin/.sshd	family_mrblack

Executes dropped EXE 2 IoCs

Processes:

getty.sshd

ioc pid process

/usr/bin/bsd-port/getty 1636 getty
/usr/bin/.sshd 1680 .sshd
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

description ioc

File opened for reading /proc/cpuinfo
Modifies init.d 1 TTPs 2 IoCs
Adds/modifies system service, likely for persistence.
persistence

Boot or Logon Autostart Execution
T1547

Processes:

description ioc

File opened for modification /etc/init.d/DbSecuritySpt
File opened for modification /etc/init.d/selinux
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

description ioc

File opened for reading /proc/net/route

ioc	pid	process
/usr/bin/bsd-port/getty	1636	getty
/usr/bin/.sshd	1680	.sshd

description	ioc
File opened for reading	/proc/cpuinfo

description	ioc
File opened for modification	/etc/init.d/DbSecuritySpt
File opened for modification	/etc/init.d/selinux

description	ioc
File opened for reading	/proc/net/route

Write file to user bin folder 1 TTPs 9 IoCs

Hijack Execution Flow

T1574

Processes:

cpcpcpcpcpcp

description	ioc
File opened for modification	/usr/bin/bsd-port/udevd.lock
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/bsd-port/getty.lock
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/conf.n

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow
T1574

Processes:

cpcp

description ioc process

File opened for modification /bin/ps cp
File opened for modification /bin/ss cp
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

description ioc

File opened for reading /proc/net/dev
File opened for reading /proc/net/route
File opened for reading /proc/net/arp

description	ioc	process
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp

description	ioc
File opened for reading	/proc/net/dev
File opened for reading	/proc/net/route
File opened for reading	/proc/net/arp

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

Processes:

mkdirinsmodmkdircpmkdircpmkdircpmkdirmkdirmkdirinsmodmkdirmkdircpcpmkdircpmkdircpcp

description	ioc	process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/meminfo
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

Processes:

description	ioc
File opened for modification	/tmp/moni.lod
File opened for modification	/tmp/bill.lock
File opened for modification	/tmp/gates.lod
File opened for modification	/tmp/notify.file
File opened for modification	/tmp/conf.n

/tmp/abc66fbc294358fb5ca8c4dd2f3e42cf.elf
/tmp/abc66fbc294358fb5ca8c4dd2f3e42cf.elf
1⤵
PID:1595

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
1⤵
PID:1610

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
2⤵
PID:1611

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
1⤵
PID:1612

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
2⤵
PID:1613

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
1⤵
PID:1614

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
2⤵
PID:1615

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
1⤵
PID:1616

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
2⤵
PID:1617

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
1⤵
PID:1618

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
2⤵
PID:1619

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1628

/bin/mkdir
mkdir -p /usr/bin/bsd-port
2⤵
- Reads runtime system information
PID:1629

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1630

/bin/mkdir
mkdir -p /usr/bin/bsd-port
2⤵
- Reads runtime system information
PID:1631

/bin/sh
sh -c "cp -f /tmp/abc66fbc294358fb5ca8c4dd2f3e42cf.elf /usr/bin/bsd-port/getty"
1⤵
PID:1632

/bin/cp
cp -f /tmp/abc66fbc294358fb5ca8c4dd2f3e42cf.elf /usr/bin/bsd-port/getty
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1633

/bin/sh
sh -c /usr/bin/bsd-port/getty
1⤵
PID:1635

/usr/bin/bsd-port/getty
/usr/bin/bsd-port/getty
2⤵
- Executes dropped EXE
PID:1636

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1648

/bin/mkdir
mkdir -p /usr/bin
2⤵
- Reads runtime system information
PID:1649

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1650

/bin/mkdir
mkdir -p /usr/bin
2⤵
- Reads runtime system information
PID:1651

/bin/sh
sh -c "cp -f /tmp/abc66fbc294358fb5ca8c4dd2f3e42cf.elf /usr/bin/.sshd"
1⤵
PID:1652

/bin/cp
cp -f /tmp/abc66fbc294358fb5ca8c4dd2f3e42cf.elf /usr/bin/.sshd
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1653

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
1⤵
PID:1654

/bin/ln
ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
2⤵
PID:1655

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
1⤵
PID:1656

/bin/ln
ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
2⤵
PID:1657

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
1⤵
PID:1658

/bin/ln
ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
2⤵
PID:1659

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
1⤵
PID:1660

/bin/ln
ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
2⤵
PID:1661

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
1⤵
PID:1662

/bin/ln
ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
2⤵
PID:1663

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
1⤵
PID:1664

/bin/mkdir
mkdir -p /usr/bin/dpkgd
2⤵
- Reads runtime system information
PID:1665

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
1⤵
PID:1666

/bin/cp
cp -f /bin/ps /usr/bin/dpkgd/ps
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1667

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1668

/bin/mkdir
mkdir -p /bin
2⤵
- Reads runtime system information
PID:1669

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1670

/bin/mkdir
mkdir -p /bin
2⤵
- Reads runtime system information
PID:1671

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
1⤵
PID:1672

/bin/cp
cp -f /usr/bin/bsd-port/getty /bin/ps
2⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1673

/bin/sh
sh -c "chmod 0755 /bin/ps"
1⤵
PID:1674

/bin/chmod
chmod 0755 /bin/ps
2⤵
PID:1675

/bin/sh
sh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"
1⤵
PID:1676

/bin/cp
cp -f /bin/ss /usr/bin/dpkgd/ss
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1677

/bin/sh
sh -c /usr/bin/.sshd
1⤵
PID:1679

/usr/bin/.sshd
/usr/bin/.sshd
2⤵
- Executes dropped EXE
PID:1680

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1681

/bin/mkdir
mkdir -p /bin
2⤵
- Reads runtime system information
PID:1682

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1683

/bin/mkdir
mkdir -p /bin
2⤵
- Reads runtime system information
PID:1684

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"
1⤵
PID:1685

/bin/cp
cp -f /usr/bin/bsd-port/getty /bin/ss
2⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1686

/bin/sh
sh -c "chmod 0755 /bin/ss"
1⤵
PID:1687

/bin/chmod
chmod 0755 /bin/ss
2⤵
PID:1688

/bin/sh
sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
1⤵
PID:1689

/bin/cp
cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1690

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1691

/bin/mkdir
mkdir -p /usr/bin
2⤵
- Reads runtime system information
PID:1692

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1693

/bin/mkdir
mkdir -p /usr/bin
2⤵
- Reads runtime system information
PID:1694

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
1⤵
PID:1695

/bin/cp
cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1696

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
1⤵
PID:1697

/bin/chmod
chmod 0755 /usr/bin/lsof
2⤵
PID:1698

/bin/sh
sh -c "insmod /usr/bin/bsd-port/xpacket.ko"
1⤵
PID:1701

/sbin/insmod
insmod /usr/bin/bsd-port/xpacket.ko
2⤵
- Reads runtime system information
PID:1702

/bin/sh
sh -c "insmod /tmp/xpacket.ko"
1⤵
PID:1708

/sbin/insmod
insmod /tmp/xpacket.ko
2⤵
- Reads runtime system information
PID:1709

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Hijack Execution Flow

T1574

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt
Filesize
54B

MD5
4a213eb67f609061181e39202f3e8007

SHA1
ae355f2ad707c70ed75dc77bfc6251495d718d77

SHA256
48a4c34e3f6ee715720890238b40a904a74ccf4799d9c9c8d6ab92bfd43cf21f

SHA512
df06104643d91cd0b6fcda5414050fd416a64c627e76f926d2807226d2f44d3695f4a737a0d84836f8e45160cf07454bd69a85ad7267713336536674841ada3f

Download Submit
/etc/init.d/selinux
Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/gates.lod
Filesize
4B

MD5
309fee4e541e51de2e41f21bebb342aa

SHA1
ee8abc188469df780d869b862fde433a2327678e

SHA256
a19fbf8bf0530ca46179b803a8234f56276f21c0e7dc2f84c682924b95de5801

SHA512
3fb050c47892b04da1c6021ebb875e271716d181db95965a26350151429613e986e7c7e26060ecd2cb508f5492ba655a52ccba8b2f95a0c88237553165fe8971

Download Submit
/tmp/moni.lod
Filesize
4B

MD5
ef2a4be5473ab0b3cc286e67b1f59f44

SHA1
ba8ce9e6f86927daaf09a1ff8aa87890d21f5588

SHA256
aeaa6370266a3650553410b0d9f8f3e02aa6bdfe68a2380a118fb3cf4a7d832f

SHA512
554785fcfa3579819d91274b5c3c3512005e74d3b7b7a46090563ec5ca49ae8f6947c4fb6aab05e522fcd08afb62b0787496838fdc0753dd4ca89c158abe472b

Download Submit
/tmp/notify.file
Filesize
41B

MD5
acb2cddb7003b4901ea19133c2a87e54

SHA1
cb79374a614395f3bf579d0016a4e5699281cd15

SHA256
1c4714215c9a57803edcfdee21ce9903a7c4b463eeb0c2d8c35f5d58a4ca20d7

SHA512
b89a50ca001118f4552501f20f11ecb6b3a94b3e453924f213e059175ac4101e6334ef56b703ca5337379d1bce9ca76cf5e223147a0f815faad3d915db559534

Download Submit
/usr/bin/.sshd
Filesize
802KB

MD5
a5b5092d0ca63d70547d3904f21219b1

SHA1
15d779254e4ab4e140997111ba44a0d24c804b2d

SHA256
99a5eb89489ad382267bb6d301111ce92f97e03c1475451bf28bb73c0d97a52c

SHA512
1cc2a01f158a7c330a12fddd57d08b5e30ae1db4f1fbf5b3190b8c74e51a2d3e7b605a7b079021b7d0c07cfa5fa143a4e2f43eae0dabd211b980988dc7905b12

Download Submit
/usr/bin/bsd-port/conf.n
Filesize
73B

MD5
4260b398928cc7125492acc11933be37

SHA1
701f3084f01c3bb361bc2c53b859e3dbb02baf72

SHA256
ccd3a82cd4e5fc061ce4d21af59342784e27bb21cf08d3aeb7868983487ac9dc

SHA512
08c8379626a80e07ae3b8697f0add1cd81174e92cdc1b717d13612740aef0d1e8872e9a0a3ab20f7a45bbdec95bda2441af2ef77751e3be11d1e6524512ce267

Download Submit
/usr/bin/bsd-port/getty
Filesize
1.2MB

MD5
abc66fbc294358fb5ca8c4dd2f3e42cf

SHA1
a89a5999f2f6c37e1316f748767113b9b211cb3e

SHA256
cfaaf70ca32d5ff133378cc0cfdc0cd5f27d91abf6853404df57208a8a7d3de4

SHA512
ac1e4b3e8190625e5a54ae078081b61e39f717c22392441f67590167f015598ba36c4a186889d715ca52cd727d2e140e98504bc70c203718e754a20e4c90f5af

Download Submit
/usr/bin/dpkgd/lsof
Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps
Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit
/usr/bin/dpkgd/ss
Filesize
136KB

MD5
1dc929b5f2cd12fe6a2fe71140d2a9e3

SHA1
f9995a92bb201b1b7738a39a38570ef0c40b52d2

SHA256
418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38

SHA512
fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373

Download Submit