Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
286s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
01/03/2024, 15:32
Behavioral task
behavioral1
Sample
b43f51ff2d22190de7506715402aa89521a55d2a24f15044103dfe6fb2cb860c
Resource
ubuntu1804-amd64-20240226-en
General
-
Target
b43f51ff2d22190de7506715402aa89521a55d2a24f15044103dfe6fb2cb860c
-
Size
1.2MB
-
MD5
274a2caa2427a5cbdd52a7eb0dd5860d
-
SHA1
8fcfea93ae7049c5f1a7679199d9f7f72deb5940
-
SHA256
b43f51ff2d22190de7506715402aa89521a55d2a24f15044103dfe6fb2cb860c
-
SHA512
38fccb019474b23bcc060f87c9707aab5ff721fc398df8fe8bebd681b7962584347b58800602e210b3a42e94262072d5592eae79e44ea57478fb23fb4c4f9645
-
SSDEEP
24576:e845rGHu6gVJKG75oFpA0VWeX4Q2y1q2rJp0:745vRVJKGtSA0VWeonu9p0
Malware Config
Signatures
-
MrBlack trojan 1 IoCs
resource yara_rule behavioral1/files/fstream-4.dat family_mrblack -
Executes dropped EXE 2 IoCs
ioc pid Process /usr/bin/bsd-port/getty 1624 getty /usr/bin/.sshd 1654 .sshd -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc File opened for reading /proc/cpuinfo -
description ioc File opened for modification /etc/init.d/DbSecuritySpt File opened for modification /etc/init.d/selinux -
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc File opened for reading /proc/net/route -
Write file to user bin folder 1 TTPs 9 IoCs
description ioc Process File opened for modification /usr/bin/bsd-port/getty cp File opened for modification /usr/bin/dpkgd/ss cp File opened for modification /usr/bin/dpkgd/lsof cp File opened for modification /usr/bin/bsd-port/conf.n Process not Found File opened for modification /usr/bin/bsd-port/getty.lock Process not Found File opened for modification /usr/bin/bsd-port/udevd.lock Process not Found File opened for modification /usr/bin/.sshd cp File opened for modification /usr/bin/dpkgd/ps cp File opened for modification /usr/bin/lsof cp -
Writes file to system bin folder 1 TTPs 2 IoCs
description ioc Process File opened for modification /bin/ps cp File opened for modification /bin/ss cp -
Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/dev File opened for reading /proc/net/route File opened for reading /proc/net/arp -
Reads runtime system information 23 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/meminfo Process not Found File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/stat Process not Found File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems cp -
Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
description ioc File opened for modification /tmp/notify.file File opened for modification /tmp/conf.n File opened for modification /tmp/moni.lod File opened for modification /tmp/bill.lock File opened for modification /tmp/gates.lod
Processes
-
/tmp/b43f51ff2d22190de7506715402aa89521a55d2a24f15044103dfe6fb2cb860c/tmp/b43f51ff2d22190de7506715402aa89521a55d2a24f15044103dfe6fb2cb860c1⤵PID:1591
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"1⤵PID:1606
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt2⤵PID:1607
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"1⤵PID:1608
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt2⤵PID:1609
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"1⤵PID:1610
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt2⤵PID:1611
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"1⤵PID:1612
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt2⤵PID:1613
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"1⤵PID:1614
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt2⤵PID:1615
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵PID:1616
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
PID:1617
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵PID:1618
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
PID:1619
-
-
/bin/shsh -c "cp -f /tmp/b43f51ff2d22190de7506715402aa89521a55d2a24f15044103dfe6fb2cb860c /usr/bin/bsd-port/getty"1⤵PID:1620
-
/bin/cpcp -f /tmp/b43f51ff2d22190de7506715402aa89521a55d2a24f15044103dfe6fb2cb860c /usr/bin/bsd-port/getty2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1621
-
-
/bin/shsh -c /usr/bin/bsd-port/getty1⤵PID:1623
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty2⤵
- Executes dropped EXE
PID:1624
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1626
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1627
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1628
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1629
-
-
/bin/shsh -c "cp -f /tmp/b43f51ff2d22190de7506715402aa89521a55d2a24f15044103dfe6fb2cb860c /usr/bin/.sshd"1⤵PID:1630
-
/bin/cpcp -f /tmp/b43f51ff2d22190de7506715402aa89521a55d2a24f15044103dfe6fb2cb860c /usr/bin/.sshd2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1631
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"1⤵PID:1632
-
/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux2⤵PID:1633
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"1⤵PID:1634
-
/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux2⤵PID:1635
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"1⤵PID:1636
-
/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux2⤵PID:1637
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"1⤵PID:1638
-
/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux2⤵PID:1639
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"1⤵PID:1640
-
/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux2⤵PID:1641
-
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"1⤵PID:1642
-
/bin/mkdirmkdir -p /usr/bin/dpkgd2⤵
- Reads runtime system information
PID:1643
-
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"1⤵PID:1644
-
/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1645
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1646
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1647
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1648
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1649
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"1⤵PID:1650
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ps2⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1651
-
-
/bin/shsh -c /usr/bin/.sshd1⤵PID:1653
-
/usr/bin/.sshd/usr/bin/.sshd2⤵
- Executes dropped EXE
PID:1654
-
-
/bin/shsh -c "chmod 0755 /bin/ps"1⤵PID:1655
-
/bin/chmodchmod 0755 /bin/ps2⤵PID:1656
-
-
/bin/shsh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"1⤵PID:1657
-
/bin/cpcp -f /bin/ss /usr/bin/dpkgd/ss2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1658
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1659
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1660
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1661
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1662
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"1⤵PID:1663
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ss2⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1664
-
-
/bin/shsh -c "chmod 0755 /bin/ss"1⤵PID:1665
-
/bin/chmodchmod 0755 /bin/ss2⤵PID:1666
-
-
/bin/shsh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"1⤵PID:1667
-
/bin/cpcp -f /usr/bin/lsof /usr/bin/dpkgd/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1668
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1669
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1670
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1671
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1672
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"1⤵PID:1673
-
/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1674
-
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"1⤵PID:1675
-
/bin/chmodchmod 0755 /usr/bin/lsof2⤵PID:1676
-
-
/bin/shsh -c "insmod /usr/bin/bsd-port/xpacket.ko"1⤵PID:1679
-
/sbin/insmodinsmod /usr/bin/bsd-port/xpacket.ko2⤵
- Reads runtime system information
PID:1680
-
-
/bin/shsh -c "insmod /tmp/xpacket.ko"1⤵PID:1686
-
/sbin/insmodinsmod /tmp/xpacket.ko2⤵
- Reads runtime system information
PID:1687
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD5746d8ff7117cc8d09091fa46ea4b80ea
SHA1e239f4c06613fae7b5ccd82acadb888143b9c7db
SHA2565fc747949b36010a1f20f27258e86a69a5e4cc9288cf75dd5c0d966d306612de
SHA5125a9e7f95b68f6eb2ae1aba7ecd540cc4c87b46e44b88631a52bdc6df149bd832b2f95513eb915cb2ecfa1a55c75bf6013375e7ce1ae500f763b8421c59586fa9
-
Filesize
36B
MD5993cc15058142d96c3daf7852c3d5ee8
SHA10950b8b391b04dd3895ea33cd3141543ebd2525d
SHA2568171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
SHA5120c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928
-
Filesize
4B
MD5d72fbbccd9fe64c3a14f85d225a046f4
SHA1348e495881ef4526fe8e38dba4ceaa49b829b8b2
SHA2568cca04ee02b8915f60a6b72c1faf19923aa12aafb5af89bc4bfd403dc60a836b
SHA51202107aa7dc8942af948b790560f406445e172eff5c838b73d0eb8d86e3021ff4bcbb310a5f3290b3ff6e46170cd36e2df76fc373b47e3b8e9f219c6f6e22d85f
-
Filesize
4B
MD508e6bea8e90ba87af3c9554d94db6579
SHA1f6c851b89dddaf2314c44b0b0fd3f7f70784fcbb
SHA25688b82308d570d71f02c5aa6a14ffe29a7ffbe14969a63094eb19e8e34256d9bf
SHA5121771fa59c930ca0a37335569539bce0e096a772b0413eb5a34894e536360c633a6df469e76393765013adda49dd394e67b9f2a17f529c8c684d2ce447343f085
-
Filesize
69B
MD5fbf50da8f95867cb9eed5e13ad2184bc
SHA16a4adee971ee5f17ea885f898ecd76c41b688be1
SHA25681f37bab27933f1cc914e717c76675b7934fd1df6eeba58def0ea84f5e7e9869
SHA5128215f903baffb324357e96084cc5c7a2a2edc864582698b1bb8d5bfb5277815592afafbcbfe9400d1b3ad43ca94c8d74f68ea91d711459debcffc6c71e3b7746
-
Filesize
73B
MD53911fae9deb2d0b407ddc3baabe41700
SHA1f10ef35d90f9f2cd7908edeb26a2350fb39886a6
SHA256801a821b9e4068684c96b77fe35b835d17aa2a0d80e7734c95c8dad4891882e2
SHA51289c03753b4fc8c553a1dd3b56c1692225c1293548ac08a7eb9fc85cbb4252ed696d0efda7e6788912eb1cfce7f440f9588afd5076daa5980d5520466a7c21165
-
Filesize
1.2MB
MD5274a2caa2427a5cbdd52a7eb0dd5860d
SHA18fcfea93ae7049c5f1a7679199d9f7f72deb5940
SHA256b43f51ff2d22190de7506715402aa89521a55d2a24f15044103dfe6fb2cb860c
SHA51238fccb019474b23bcc060f87c9707aab5ff721fc398df8fe8bebd681b7962584347b58800602e210b3a42e94262072d5592eae79e44ea57478fb23fb4c4f9645
-
Filesize
159KB
MD5e093dc78225e2a0a25e3b137c1c1e442
SHA1c29497cfaae729eb576875e4fdfa400640ab16be
SHA2561190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
SHA512fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
-
Filesize
130KB
MD5558edc26f8a38fa9788220b9af8a73e7
SHA13024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA256b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
SHA512edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f
-
Filesize
136KB
MD51dc929b5f2cd12fe6a2fe71140d2a9e3
SHA1f9995a92bb201b1b7738a39a38570ef0c40b52d2
SHA256418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38
SHA512fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373