Analysis
-
max time kernel
149s -
max time network
131s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
04-05-2024 10:08
Behavioral task
behavioral1
Sample
f57f99f56834d73211bac97f4ec2dc5c.elf
Resource
ubuntu1804-amd64-20240226-en
General
-
Target
f57f99f56834d73211bac97f4ec2dc5c.elf
-
Size
1.1MB
-
MD5
f57f99f56834d73211bac97f4ec2dc5c
-
SHA1
314fff2c301fb120ce100e812e3ef4b31580551d
-
SHA256
a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60
-
SHA512
c2785a0b3231ccd5c217f6ec38aa8ca3ece2cc3a3364a3271582ba49cf9ac8a5dfd163765c6284ba72c9bd4e711cc059ba328e6a7ad0b1adeb7e85447b9350a8
-
SSDEEP
24576:4vRE7caCfKGPqVEDNLFxKsfa1I+gIGYuuCol7r:4vREKfPqVE5jKsfa1RHGVo7r
Malware Config
Signatures
-
MrBlack trojan 1 IoCs
Processes:
resource yara_rule /usr/bin/bsd-port/recei family_mrblack -
Executes dropped EXE 2 IoCs
Processes:
receioracleioc pid process /usr/bin/bsd-port/recei 1614 recei /usr/bin/oracle 1632 oracle -
Processes:
f57f99f56834d73211bac97f4ec2dc5c.elfreceidescription ioc process File opened for modification /etc/init.d/VsystemsshMmt f57f99f56834d73211bac97f4ec2dc5c.elf File opened for modification /etc/init.d/selinux recei -
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
Processes:
f57f99f56834d73211bac97f4ec2dc5c.elfdescription ioc process File opened for reading /proc/net/route f57f99f56834d73211bac97f4ec2dc5c.elf -
Write file to user bin folder 1 TTPs 8 IoCs
Processes:
cpreceicpcpcpcpf57f99f56834d73211bac97f4ec2dc5c.elfdescription ioc process File opened for modification /usr/bin/bsd-port/recei cp File opened for modification /usr/bin/bsd-port/recei.conf recei File opened for modification /usr/bin/oracle cp File opened for modification /usr/bin/dpkgd/ps cp File opened for modification /usr/bin/dpkgd/lsof cp File opened for modification /usr/bin/lsof cp File opened for modification /usr/bin/bsd-port/recei.conf f57f99f56834d73211bac97f4ec2dc5c.elf File opened for modification /usr/bin/bsd-port/udevd.conf f57f99f56834d73211bac97f4ec2dc5c.elf -
Writes file to system bin folder 1 TTPs 1 IoCs
Processes:
cpdescription ioc process File opened for modification /bin/ps cp -
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
f57f99f56834d73211bac97f4ec2dc5c.elfreceidescription ioc process File opened for reading /proc/cpuinfo f57f99f56834d73211bac97f4ec2dc5c.elf File opened for reading /proc/cpuinfo recei -
Reads system network configuration 1 TTPs 4 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
f57f99f56834d73211bac97f4ec2dc5c.elfreceidescription ioc process File opened for reading /proc/net/route f57f99f56834d73211bac97f4ec2dc5c.elf File opened for reading /proc/net/arp f57f99f56834d73211bac97f4ec2dc5c.elf File opened for reading /proc/net/dev f57f99f56834d73211bac97f4ec2dc5c.elf File opened for reading /proc/net/dev recei -
Reads runtime system information 17 IoCs
Reads data from /proc virtual filesystem.
Processes:
f57f99f56834d73211bac97f4ec2dc5c.elfmkdirmkdircpmkdircpmkdirinsmodcpinsmodcpcpmkdircpreceidescription ioc process File opened for reading /proc/stat f57f99f56834d73211bac97f4ec2dc5c.elf File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/meminfo f57f99f56834d73211bac97f4ec2dc5c.elf File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems cp File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/stat recei File opened for reading /proc/meminfo recei -
Writes file to tmp directory 8 IoCs
Malware often drops required files in the /tmp directory.
Processes:
f57f99f56834d73211bac97f4ec2dc5c.elforacledescription ioc process File opened for modification /tmp/Dest.cfg f57f99f56834d73211bac97f4ec2dc5c.elf File opened for modification /tmp/notify.file f57f99f56834d73211bac97f4ec2dc5c.elf File opened for modification /tmp/conf.n f57f99f56834d73211bac97f4ec2dc5c.elf File opened for modification /tmp/appd.log oracle File opened for modification /tmp/notify.file oracle File opened for modification /tmp/Dest.cfg oracle File opened for modification /tmp/appd.log f57f99f56834d73211bac97f4ec2dc5c.elf File opened for modification /tmp/appd.conf f57f99f56834d73211bac97f4ec2dc5c.elf
Processes
-
/tmp/f57f99f56834d73211bac97f4ec2dc5c.elf/tmp/f57f99f56834d73211bac97f4ec2dc5c.elf1⤵
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1569 -
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc1.d/S97VsystemsshMmt"2⤵PID:1598
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc1.d/S97VsystemsshMmt3⤵PID:1599
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc2.d/S97VsystemsshMmt"2⤵PID:1600
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc2.d/S97VsystemsshMmt3⤵PID:1601
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc3.d/S97VsystemsshMmt"2⤵PID:1602
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc3.d/S97VsystemsshMmt3⤵PID:1603
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc4.d/S97VsystemsshMmt"2⤵PID:1604
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc4.d/S97VsystemsshMmt3⤵PID:1605
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc5.d/S97VsystemsshMmt"2⤵PID:1606
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc5.d/S97VsystemsshMmt3⤵PID:1607
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"2⤵PID:1608
-
/bin/mkdirmkdir -p /usr/bin/bsd-port3⤵
- Reads runtime system information
PID:1609 -
/bin/shsh -c "cp -f /tmp/f57f99f56834d73211bac97f4ec2dc5c.elf /usr/bin/bsd-port/recei"2⤵PID:1610
-
/bin/cpcp -f /tmp/f57f99f56834d73211bac97f4ec2dc5c.elf /usr/bin/bsd-port/recei3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1611 -
/bin/shsh -c /usr/bin/bsd-port/recei2⤵PID:1613
-
/usr/bin/bsd-port/recei/usr/bin/bsd-port/recei3⤵
- Executes dropped EXE
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
PID:1614 -
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"4⤵PID:1620
-
/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux5⤵PID:1621
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"4⤵PID:1622
-
/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux5⤵PID:1623
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"4⤵PID:1624
-
/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux5⤵PID:1625
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"4⤵PID:1626
-
/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux5⤵PID:1627
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"4⤵PID:1628
-
/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux5⤵PID:1629
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"4⤵PID:1635
-
/bin/mkdirmkdir -p /usr/bin/dpkgd5⤵
- Reads runtime system information
PID:1637 -
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"4⤵PID:1638
-
/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1639 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1641
-
/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1642 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/recei /bin/ps"4⤵PID:1644
-
/bin/cpcp -f /usr/bin/bsd-port/recei /bin/ps5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1645 -
/bin/shsh -c "chmod 0755 /bin/ps"4⤵PID:1646
-
/bin/chmodchmod 0755 /bin/ps5⤵PID:1647
-
/bin/shsh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"4⤵PID:1649
-
/bin/cpcp -f /usr/bin/lsof /usr/bin/dpkgd/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1650 -
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1652
-
/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1653 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/recei /usr/bin/lsof"4⤵PID:1654
-
/bin/cpcp -f /usr/bin/bsd-port/recei /usr/bin/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1655 -
/bin/shsh -c "chmod 0755 /usr/bin/lsof"4⤵PID:1657
-
/bin/chmodchmod 0755 /usr/bin/lsof5⤵PID:1658
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"4⤵PID:1659
-
/sbin/insmodinsmod /usr/lib/xpacket.ko5⤵
- Reads runtime system information
PID:1661 -
/bin/shsh -c "mkdir -p /usr/bin"2⤵PID:1616
-
/bin/mkdirmkdir -p /usr/bin3⤵
- Reads runtime system information
PID:1617 -
/bin/shsh -c "cp -f /tmp/f57f99f56834d73211bac97f4ec2dc5c.elf /usr/bin/oracle"2⤵PID:1618
-
/bin/cpcp -f /tmp/f57f99f56834d73211bac97f4ec2dc5c.elf /usr/bin/oracle3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1619 -
/bin/shsh -c /usr/bin/oracle2⤵PID:1631
-
/usr/bin/oracle/usr/bin/oracle3⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1632 -
/bin/shsh -c "insmod /usr/lib/xpacket.ko"2⤵PID:1634
-
/sbin/insmodinsmod /usr/lib/xpacket.ko3⤵
- Reads runtime system information
PID:1636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54B
MD5780d1e94fbf15a6e57e7ff8d970ee4bf
SHA1e7d237d21609781d96de3aebc496990290912422
SHA256ca7a6faf512c369e20446026ac2f5bc03fab12d58e983877bfda2fce483cf512
SHA512d38c1c89c140b17aa93142440a00a9dc328daf0bbe1c3664cf9c08ddaad1eaf3ae5c2d803b8cc5bfad2c35f80a65cf929335dfe31bd4d1ba1fb3fa51b3c3ed01
-
Filesize
36B
MD557cde9c165195cfb90c212057795ed49
SHA1d77d9895306eb09ad9b54588fb7998c79c671563
SHA2563e3488e9c63dfadffd594301e2192418b158238bfb8f83d6702123d72892cf36
SHA512de9af53a508167cbbb820a99c2742918ec5b8c83877b77e43e4b441019311685647f47fb4666ba53ecef4e6a2d5514eb67981d471ddf173b04848609b3c0c00d
-
Filesize
4B
MD57bd28f15a49d5e5848d6ec70e584e625
SHA1d2fce7d4fae7323ea1b94f177e0a41a42fe0dd09
SHA256aded40e220d2587b0ef1f88302a192d411bc55ddff1c4d818177777d6060a490
SHA512f0ce80170e4bfc2929af244040c4d5dd5d317e80d3cac9883f162e55478b9825d07aa9114b8bb48f74fe28396ee02a2c59710b9d1109b6456ce4593cb1659d67
-
Filesize
41B
MD5dcde7e8ce1b38785cd5d991edc31fee0
SHA1857dce373987a8c7483829525c3c2f7b26ee506f
SHA256cfc55c6c3cb3b4e530b9656b261c18b214c9dfad659c856317b47078e211032b
SHA5125ee489b47fb04b2742eb61e72d805add50d78caf19b1dd7da4757a9987cd11c9e4028f77881b96888d54139343bf0ece1265da8406cce78424a54bd38201a74d
-
Filesize
1.1MB
MD5f57f99f56834d73211bac97f4ec2dc5c
SHA1314fff2c301fb120ce100e812e3ef4b31580551d
SHA256a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60
SHA512c2785a0b3231ccd5c217f6ec38aa8ca3ece2cc3a3364a3271582ba49cf9ac8a5dfd163765c6284ba72c9bd4e711cc059ba328e6a7ad0b1adeb7e85447b9350a8
-
Filesize
159KB
MD5e093dc78225e2a0a25e3b137c1c1e442
SHA1c29497cfaae729eb576875e4fdfa400640ab16be
SHA2561190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
SHA512fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
-
Filesize
130KB
MD5558edc26f8a38fa9788220b9af8a73e7
SHA13024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA256b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
SHA512edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f