Analysis
-
max time kernel
149s -
max time network
131s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
-
submitted
04-05-2024 10:08
General
-
Target
f57f99f56834d73211bac97f4ec2dc5c.elf
-
Size
1.1MB
-
MD5
f57f99f56834d73211bac97f4ec2dc5c
-
SHA1
314fff2c301fb120ce100e812e3ef4b31580551d
-
SHA256
a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60
-
SHA512
c2785a0b3231ccd5c217f6ec38aa8ca3ece2cc3a3364a3271582ba49cf9ac8a5dfd163765c6284ba72c9bd4e711cc059ba328e6a7ad0b1adeb7e85447b9350a8
-
SSDEEP
24576:4vRE7caCfKGPqVEDNLFxKsfa1I+gIGYuuCol7r:4vREKfPqVE5jKsfa1RHGVo7r
Malware Config
Signatures
-
MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
-
MrBlack trojan 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Modifies init.d 1 TTPs 2 IoCs
Adds/modifies system service, likely for persistence.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Write file to user bin folder 1 TTPs 8 IoCs
-
Writes file to system bin folder 1 TTPs 1 IoCs
-
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads system network configuration 1 TTPs 4 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 17 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 8 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/f57f99f56834d73211bac97f4ec2dc5c.elf/tmp/f57f99f56834d73211bac97f4ec2dc5c.elf1⤵
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc1.d/S97VsystemsshMmt"2⤵
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc1.d/S97VsystemsshMmt3⤵
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc2.d/S97VsystemsshMmt"2⤵
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc2.d/S97VsystemsshMmt3⤵
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc3.d/S97VsystemsshMmt"2⤵
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc3.d/S97VsystemsshMmt3⤵
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc4.d/S97VsystemsshMmt"2⤵
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc4.d/S97VsystemsshMmt3⤵
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc5.d/S97VsystemsshMmt"2⤵
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc5.d/S97VsystemsshMmt3⤵
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"2⤵
-
/bin/mkdirmkdir -p /usr/bin/bsd-port3⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /tmp/f57f99f56834d73211bac97f4ec2dc5c.elf /usr/bin/bsd-port/recei"2⤵
-
/bin/cpcp -f /tmp/f57f99f56834d73211bac97f4ec2dc5c.elf /usr/bin/bsd-port/recei3⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c /usr/bin/bsd-port/recei2⤵
-
/usr/bin/bsd-port/recei/usr/bin/bsd-port/recei3⤵
- Executes dropped EXE
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"4⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux5⤵
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"4⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux5⤵
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"4⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux5⤵
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"4⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux5⤵
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"4⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux5⤵
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"4⤵
-
/bin/mkdirmkdir -p /usr/bin/dpkgd5⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"4⤵
-
/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps5⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /bin"4⤵
-
/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/recei /bin/ps"4⤵
-
/bin/cpcp -f /usr/bin/bsd-port/recei /bin/ps5⤵
- Writes file to system bin folder
- Reads runtime system information
-
/bin/shsh -c "chmod 0755 /bin/ps"4⤵
-
/bin/chmodchmod 0755 /bin/ps5⤵
-
/bin/shsh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"4⤵
-
/bin/cpcp -f /usr/bin/lsof /usr/bin/dpkgd/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵
-
/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/recei /usr/bin/lsof"4⤵
-
/bin/cpcp -f /usr/bin/bsd-port/recei /usr/bin/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"4⤵
-
/bin/chmodchmod 0755 /usr/bin/lsof5⤵
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"4⤵
-
/sbin/insmodinsmod /usr/lib/xpacket.ko5⤵
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /usr/bin"2⤵
-
/bin/mkdirmkdir -p /usr/bin3⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /tmp/f57f99f56834d73211bac97f4ec2dc5c.elf /usr/bin/oracle"2⤵
-
/bin/cpcp -f /tmp/f57f99f56834d73211bac97f4ec2dc5c.elf /usr/bin/oracle3⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c /usr/bin/oracle2⤵
-
/usr/bin/oracle/usr/bin/oracle3⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"2⤵
-
/sbin/insmodinsmod /usr/lib/xpacket.ko3⤵
- Reads runtime system information
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
/etc/init.d/VsystemsshMmtFilesize
54B
MD5780d1e94fbf15a6e57e7ff8d970ee4bf
SHA1e7d237d21609781d96de3aebc496990290912422
SHA256ca7a6faf512c369e20446026ac2f5bc03fab12d58e983877bfda2fce483cf512
SHA512d38c1c89c140b17aa93142440a00a9dc328daf0bbe1c3664cf9c08ddaad1eaf3ae5c2d803b8cc5bfad2c35f80a65cf929335dfe31bd4d1ba1fb3fa51b3c3ed01
-
/etc/init.d/selinuxFilesize
36B
MD557cde9c165195cfb90c212057795ed49
SHA1d77d9895306eb09ad9b54588fb7998c79c671563
SHA2563e3488e9c63dfadffd594301e2192418b158238bfb8f83d6702123d72892cf36
SHA512de9af53a508167cbbb820a99c2742918ec5b8c83877b77e43e4b441019311685647f47fb4666ba53ecef4e6a2d5514eb67981d471ddf173b04848609b3c0c00d
-
/tmp/Dest.cfgFilesize
4B
MD57bd28f15a49d5e5848d6ec70e584e625
SHA1d2fce7d4fae7323ea1b94f177e0a41a42fe0dd09
SHA256aded40e220d2587b0ef1f88302a192d411bc55ddff1c4d818177777d6060a490
SHA512f0ce80170e4bfc2929af244040c4d5dd5d317e80d3cac9883f162e55478b9825d07aa9114b8bb48f74fe28396ee02a2c59710b9d1109b6456ce4593cb1659d67
-
/tmp/notify.fileFilesize
41B
MD5dcde7e8ce1b38785cd5d991edc31fee0
SHA1857dce373987a8c7483829525c3c2f7b26ee506f
SHA256cfc55c6c3cb3b4e530b9656b261c18b214c9dfad659c856317b47078e211032b
SHA5125ee489b47fb04b2742eb61e72d805add50d78caf19b1dd7da4757a9987cd11c9e4028f77881b96888d54139343bf0ece1265da8406cce78424a54bd38201a74d
-
/usr/bin/bsd-port/receiFilesize
1.1MB
MD5f57f99f56834d73211bac97f4ec2dc5c
SHA1314fff2c301fb120ce100e812e3ef4b31580551d
SHA256a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60
SHA512c2785a0b3231ccd5c217f6ec38aa8ca3ece2cc3a3364a3271582ba49cf9ac8a5dfd163765c6284ba72c9bd4e711cc059ba328e6a7ad0b1adeb7e85447b9350a8
-
/usr/bin/dpkgd/lsofFilesize
159KB
MD5e093dc78225e2a0a25e3b137c1c1e442
SHA1c29497cfaae729eb576875e4fdfa400640ab16be
SHA2561190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
SHA512fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
-
/usr/bin/dpkgd/psFilesize
130KB
MD5558edc26f8a38fa9788220b9af8a73e7
SHA13024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA256b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
SHA512edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f