Analysis
-
max time kernel
1799s -
max time network
1751s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
-
submitted
04-05-2024 20:04
General
-
Target
94156
-
Size
1.1MB
-
MD5
7d1343b3ab670b162fb2ce8854f01167
-
SHA1
de95e608dd0e97d5eca90b6b6d747465980d4857
-
SHA256
6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23
-
SHA512
22ff942fcaabe8a63919a53bf68642dd45943ef3c24e558b18d51ca5c4c0209be653ec268f9d0f64b5634e9dd3e32f7eacdb746fd2263907c0f8f33d89dd91be
-
SSDEEP
24576:4vRE7caCfKGPqVEDNLFxKsfawI+gIGYuuCol7r:4vREKfPqVE5jKsfawRHGVo7r
Malware Config
Signatures
-
MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
-
MrBlack trojan 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Modifies init.d 1 TTPs 2 IoCs
Adds/modifies system service, likely for persistence.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Write file to user bin folder 1 TTPs 8 IoCs
-
Writes file to system bin folder 1 TTPs 1 IoCs
-
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads system network configuration 1 TTPs 4 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 17 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 8 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/94156/tmp/941561⤵
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt"2⤵
-
/bin/lnln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt3⤵
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt"2⤵
-
/bin/lnln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt3⤵
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt"2⤵
-
/bin/lnln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt3⤵
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt"2⤵
-
/bin/lnln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt3⤵
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt"2⤵
-
/bin/lnln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt3⤵
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"2⤵
-
/bin/mkdirmkdir -p /usr/bin/bsd-port3⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /tmp/94156 /usr/bin/bsd-port/knerl"2⤵
-
/bin/cpcp -f /tmp/94156 /usr/bin/bsd-port/knerl3⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c /usr/bin/bsd-port/knerl2⤵
-
/usr/bin/bsd-port/knerl/usr/bin/bsd-port/knerl3⤵
- Executes dropped EXE
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"4⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux5⤵
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"4⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux5⤵
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"4⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux5⤵
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"4⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux5⤵
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"4⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux5⤵
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"4⤵
-
/bin/mkdirmkdir -p /usr/bin/dpkgd5⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"4⤵
-
/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps5⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /bin"4⤵
-
/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/knerl /bin/ps"4⤵
-
/bin/cpcp -f /usr/bin/bsd-port/knerl /bin/ps5⤵
- Writes file to system bin folder
- Reads runtime system information
-
/bin/shsh -c "chmod 0755 /bin/ps"4⤵
-
/bin/chmodchmod 0755 /bin/ps5⤵
-
/bin/shsh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"4⤵
-
/bin/cpcp -f /usr/bin/lsof /usr/bin/dpkgd/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵
-
/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/knerl /usr/bin/lsof"4⤵
-
/bin/cpcp -f /usr/bin/bsd-port/knerl /usr/bin/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"4⤵
-
/bin/chmodchmod 0755 /usr/bin/lsof5⤵
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"4⤵
-
/sbin/insmodinsmod /usr/lib/xpacket.ko5⤵
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /usr/bin"2⤵
-
/bin/mkdirmkdir -p /usr/bin3⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /tmp/94156 /usr/bin/pythno"2⤵
-
/bin/cpcp -f /tmp/94156 /usr/bin/pythno3⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c /usr/bin/pythno2⤵
-
/usr/bin/pythno/usr/bin/pythno3⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"2⤵
-
/sbin/insmodinsmod /usr/lib/xpacket.ko3⤵
- Reads runtime system information
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23B
MD59bbb6a1166b0609335a9aec9ba84eddf
SHA157a247f2cfcf3673ff81dd8b94c3da764927451c
SHA256cb1c6e32a683e01650d11c9ddaebd2815726f59fcdd1612d50a0edc6c2918d6d
SHA512cab11d7253c1f50b5c0719b26f19b766a20f6731a6867ad3603cd3f89d026037e1497c11c09381e555858c10b39bbd722155c6716d8f64e917be72898ace79ba
-
Filesize
36B
MD5caa27b819c9303446f702929874a00e8
SHA1d24199c0e376edea3f822b215148cc0dc78364bf
SHA256da9b535a14c6d9152857e211f14fb8da9056e84ba1b8d4dc27ab79c98264050b
SHA512dcd9413eb2cb24d77f637edfc00ca0bb42229a1a3b0d84e29eff94a7b91aee6ee8c126c286a4b4103e01834d1c6aec9de09ffab3927e8de8015421005f31446e
-
Filesize
4B
MD5faafda66202d234463057972460c04f5
SHA1b08fff87998d20605f134b632cb8fa3398008116
SHA256b2382de3cdaaf0c8e505cd370821d7842e493a1e64160dc6991b1109e2938a21
SHA5122c743b3f56b8ed3295341971cce16d94043522e565ce09214fe8d21ef68d5a1dd355fe97da6770bd856c3241f4d7ced45a17962bda8cf542c0d1f4c17f6fbd7b
-
Filesize
10B
MD52aa6f0df6171f7a70882ae565ea552e9
SHA1e28035a12917a231993fbdfbf829630b0f56f196
SHA256a3efaa09fd6f13fe37590d5059edc3af280c4826b650707546c2f95b271dfd75
SHA5121c00b642267dac4ef6f78927b2c6dc868289e4f56f00886647939720db228a9aff109770c448a44b21a676a05e5b3e7a093444ab2503e7a1ff616a392630b39d
-
Filesize
4B
MD5facf9f743b083008a894eee7baa16469
SHA1fe286d02f80118de47f2226c2fce9f7be0bc04f0
SHA2562163909115c0f6f1e638bd2c2279387cbe37cc327150a7b5cddfde3d1cd4ef0e
SHA5127bd3d1d347d68f23d612a3ec7a1d2f4094874162441bae20122876ea980bbb76a3c46d5d2e393975ea0659fb2b58046a311d7660f226482a57a74e9ffd9b0f36
-
Filesize
1.1MB
MD57d1343b3ab670b162fb2ce8854f01167
SHA1de95e608dd0e97d5eca90b6b6d747465980d4857
SHA2566674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23
SHA51222ff942fcaabe8a63919a53bf68642dd45943ef3c24e558b18d51ca5c4c0209be653ec268f9d0f64b5634e9dd3e32f7eacdb746fd2263907c0f8f33d89dd91be
-
Filesize
159KB
MD5e093dc78225e2a0a25e3b137c1c1e442
SHA1c29497cfaae729eb576875e4fdfa400640ab16be
SHA2561190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
SHA512fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
-
Filesize
130KB
MD5558edc26f8a38fa9788220b9af8a73e7
SHA13024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA256b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
SHA512edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f