Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
22/03/2024, 16:06
240322-tkbewafh2t 1022/03/2024, 16:03
240322-thwb9sfg8t 1022/03/2024, 08:44
240322-km5xtsae28 10Analysis
-
max time kernel
127s -
max time network
154s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
22/03/2024, 16:06
Behavioral task
behavioral1
Sample
9c65f61859b4b8ae00c79ddd63abf60d.elf
Resource
ubuntu1804-amd64-20240226-en
General
-
Target
9c65f61859b4b8ae00c79ddd63abf60d.elf
-
Size
1.2MB
-
MD5
9c65f61859b4b8ae00c79ddd63abf60d
-
SHA1
ddf2c1d0abdef832ec746004dcdfd0cd800048ae
-
SHA256
fab8944e3f0541c0ff149306ea74137f7c1e9c081670906844769a45aa7171b4
-
SHA512
ed39ef838a9cdff65e891f65a98800ebd282645e13d9f83a6b620e3bc573a3fae8e5f312136b970977a4cdbdf5a0e600be401cf425a2d673d30c715562ab163e
-
SSDEEP
24576:e845rGHu6gVJKG75oFpA0VWeX4a2y1q2rJp0:745vRVJKGtSA0VWeoZu9p0
Malware Config
Signatures
-
MrBlack trojan 1 IoCs
resource yara_rule behavioral1/files/fstream-4.dat family_mrblack -
Executes dropped EXE 2 IoCs
ioc pid Process /usr/bin/bsd-port/getty 1886 getty /usr/bin/.sshd 1932 .sshd -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc File opened for reading /proc/cpuinfo -
description ioc File opened for modification /etc/init.d/DbSecuritySpt File opened for modification /etc/init.d/selinux -
Write file to user bin folder 1 TTPs 8 IoCs
description ioc Process File opened for modification /usr/bin/dpkgd/ss cp File opened for modification /usr/bin/dpkgd/lsof cp File opened for modification /usr/bin/lsof cp File opened for modification /usr/bin/bsd-port/getty.lock Process not Found File opened for modification /usr/bin/bsd-port/udevd.lock Process not Found File opened for modification /usr/bin/bsd-port/getty cp File opened for modification /usr/bin/.sshd cp File opened for modification /usr/bin/dpkgd/ps cp -
Writes file to system bin folder 1 TTPs 2 IoCs
description ioc Process File opened for modification /bin/ps cp File opened for modification /bin/ss cp -
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc File opened for reading /proc/net/dev -
Reads runtime system information 22 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/meminfo Process not Found File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/stat Process not Found -
Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
description ioc File opened for modification /tmp/moni.lod File opened for modification /tmp/bill.lock File opened for modification /tmp/gates.lod File opened for modification /tmp/notify.file
Processes
-
/tmp/9c65f61859b4b8ae00c79ddd63abf60d.elf/tmp/9c65f61859b4b8ae00c79ddd63abf60d.elf1⤵PID:1521
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"1⤵PID:1544
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt2⤵PID:1545
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"1⤵PID:1546
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt2⤵PID:1547
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"1⤵PID:1548
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt2⤵PID:1549
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"1⤵PID:1550
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt2⤵PID:1551
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"1⤵PID:1552
-
/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt2⤵PID:1553
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵PID:1670
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
PID:1671
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"1⤵PID:1672
-
/bin/mkdirmkdir -p /usr/bin/bsd-port2⤵
- Reads runtime system information
PID:1673
-
-
/bin/shsh -c "cp -f /tmp/9c65f61859b4b8ae00c79ddd63abf60d.elf /usr/bin/bsd-port/getty"1⤵PID:1674
-
/bin/cpcp -f /tmp/9c65f61859b4b8ae00c79ddd63abf60d.elf /usr/bin/bsd-port/getty2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1675
-
-
/bin/shsh -c /usr/bin/bsd-port/getty1⤵PID:1885
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty2⤵
- Executes dropped EXE
PID:1886
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1917
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1918
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1919
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1920
-
-
/bin/shsh -c "cp -f /tmp/9c65f61859b4b8ae00c79ddd63abf60d.elf /usr/bin/.sshd"1⤵PID:1921
-
/bin/cpcp -f /tmp/9c65f61859b4b8ae00c79ddd63abf60d.elf /usr/bin/.sshd2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1922
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"1⤵PID:1923
-
/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux2⤵PID:1924
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"1⤵PID:1925
-
/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux2⤵PID:1926
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"1⤵PID:1927
-
/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux2⤵PID:1928
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"1⤵PID:1929
-
/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux2⤵PID:1933
-
-
/bin/shsh -c /usr/bin/.sshd1⤵PID:1931
-
/usr/bin/.sshd/usr/bin/.sshd2⤵
- Executes dropped EXE
PID:1932
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"1⤵PID:1934
-
/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux2⤵PID:1935
-
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"1⤵PID:1936
-
/bin/mkdirmkdir -p /usr/bin/dpkgd2⤵
- Reads runtime system information
PID:1937
-
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"1⤵PID:1938
-
/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1939
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1940
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1941
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1942
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1943
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"1⤵PID:1944
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ps2⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1945
-
-
/bin/shsh -c "chmod 0755 /bin/ps"1⤵PID:1946
-
/bin/chmodchmod 0755 /bin/ps2⤵PID:1947
-
-
/bin/shsh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"1⤵PID:1948
-
/bin/cpcp -f /bin/ss /usr/bin/dpkgd/ss2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1949
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1950
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1951
-
-
/bin/shsh -c "mkdir -p /bin"1⤵PID:1952
-
/bin/mkdirmkdir -p /bin2⤵
- Reads runtime system information
PID:1953
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"1⤵PID:1954
-
/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ss2⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1955
-
-
/bin/shsh -c "chmod 0755 /bin/ss"1⤵PID:1956
-
/bin/chmodchmod 0755 /bin/ss2⤵PID:1957
-
-
/bin/shsh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"1⤵PID:1958
-
/bin/cpcp -f /usr/bin/lsof /usr/bin/dpkgd/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1959
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1960
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1961
-
-
/bin/shsh -c "mkdir -p /usr/bin"1⤵PID:1962
-
/bin/mkdirmkdir -p /usr/bin2⤵
- Reads runtime system information
PID:1963
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"1⤵PID:1964
-
/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/lsof2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1965
-
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"1⤵PID:1966
-
/bin/chmodchmod 0755 /usr/bin/lsof2⤵PID:1967
-
-
/bin/shsh -c "insmod /usr/bin/bsd-port/xpacket.ko"1⤵PID:1970
-
/sbin/insmodinsmod /usr/bin/bsd-port/xpacket.ko2⤵
- Reads runtime system information
PID:1971
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54B
MD5c72f90e3e98d1e442f1c67250d65462e
SHA11226c9d54cd8f96cd14bdb3145b8e8feb552fac5
SHA256933e302e728da769ffdf8f69c9dd2ed8519ef8bd832c94804446b4ad95f1b55e
SHA51225e3d20741be4ceca8e8320e7853ece8224895f6b7ec3d624b84cb37c7989aff6d9ee83331f55ea42bd07a71840176fe0058c23ea25c792de5ad583d012e58ca
-
Filesize
36B
MD5993cc15058142d96c3daf7852c3d5ee8
SHA10950b8b391b04dd3895ea33cd3141543ebd2525d
SHA2568171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
SHA5120c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928
-
Filesize
4B
MD53fb451ca2e89b3a13095b059d8705b15
SHA1c718aa30a6ff882b7087ce4f1567e335ea77186e
SHA256ff231d4dee9c91e9ead0253639c25479b934a352b052aa23ad05f6b79efa137b
SHA5122a884cd727e33e07069954b36adfcf7444b94695a26af2410c66758b9412af486952e61193fac69ad338270598b10e2920b1f25563545280e3e87d678cbb7e25
-
Filesize
4B
MD598c7242894844ecd6ec94af67ac8247d
SHA172a9500430e3b5bd0680cbdedd4ae13de468c35a
SHA256a48622b535728587fd351763d1296c7ec9cb5bc6743d5f22b011d5b5c3ef688f
SHA5127f0effe68daaf9bfa852d061f7b5c682e5da8707ee480c2c3b47838958bd45f2387cb4127aaa6342389894ec7cc4502c36ea6812ad96d335b62165f8bd9ba161
-
Filesize
41B
MD5aada6ae77c35c99d34d3c1fa2bc89bd4
SHA1eef93661c4caa0a32ec663a0462718d60d279fee
SHA25655578939d73ca332c68f76d7e88818a529fee6990dfa757a9bf41a9735a56deb
SHA512781ed7115d089dc7f57e85d2396da1c23041e5738d6e800393b80d2b4971dfcffabec57b1ee06c87228eee832b658a57dfc20cd5a534bd765760cd3d85526d85
-
Filesize
1.2MB
MD59c65f61859b4b8ae00c79ddd63abf60d
SHA1ddf2c1d0abdef832ec746004dcdfd0cd800048ae
SHA256fab8944e3f0541c0ff149306ea74137f7c1e9c081670906844769a45aa7171b4
SHA512ed39ef838a9cdff65e891f65a98800ebd282645e13d9f83a6b620e3bc573a3fae8e5f312136b970977a4cdbdf5a0e600be401cf425a2d673d30c715562ab163e
-
Filesize
159KB
MD5e093dc78225e2a0a25e3b137c1c1e442
SHA1c29497cfaae729eb576875e4fdfa400640ab16be
SHA2561190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
SHA512fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
-
Filesize
130KB
MD5558edc26f8a38fa9788220b9af8a73e7
SHA13024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA256b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
SHA512edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f
-
Filesize
136KB
MD51dc929b5f2cd12fe6a2fe71140d2a9e3
SHA1f9995a92bb201b1b7738a39a38570ef0c40b52d2
SHA256418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38
SHA512fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373