Overview

overview

10

Static

static

10

94156

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    1799s
  • max time network
    1751s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240226-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    04-05-2024 20:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    94156

  • Size

    1.1MB

  • MD5

    7d1343b3ab670b162fb2ce8854f01167

  • SHA1

    de95e608dd0e97d5eca90b6b6d747465980d4857

  • SHA256

    6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23

  • SHA512

    22ff942fcaabe8a63919a53bf68642dd45943ef3c24e558b18d51ca5c4c0209be653ec268f9d0f64b5634e9dd3e32f7eacdb746fd2263907c0f8f33d89dd91be

  • SSDEEP

    24576:4vRE7caCfKGPqVEDNLFxKsfawI+gIGYuuCol7r:4vREKfPqVE5jKsfawRHGVo7r

Score
10/10
mrblackantivmbotnetpersistencetrojan

Malware Config

Signatures

  • MrBlack Trojan

    IoT botnet which infects routers to be used for DDoS attacks.

    trojanbotnetmrblack
  • MrBlack trojan 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies init.d 1 TTPs 2 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

  • Write file to user bin folder 1 TTPs 8 IoCs
  • Writes file to system bin folder 1 TTPs 1 IoCs
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 4 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 17 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/94156
    /tmp/94156
    1⤵
    • Modifies init.d
    • Reads system routing table
    • Write file to user bin folder
    • Checks CPU configuration
    • Reads system network configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1563
    • /bin/sh
      sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt"
      2⤵
        PID:1569
        • /bin/ln
          ln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt
          3⤵
            PID:1570
        • /bin/sh
          sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt"
          2⤵
            PID:1571
            • /bin/ln
              ln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt
              3⤵
                PID:1572
            • /bin/sh
              sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt"
              2⤵
                PID:1573
                • /bin/ln
                  ln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt
                  3⤵
                    PID:1574
                • /bin/sh
                  sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt"
                  2⤵
                    PID:1575
                    • /bin/ln
                      ln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt
                      3⤵
                        PID:1576
                    • /bin/sh
                      sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt"
                      2⤵
                        PID:1577
                        • /bin/ln
                          ln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt
                          3⤵
                            PID:1578
                        • /bin/sh
                          sh -c "mkdir -p /usr/bin/bsd-port"
                          2⤵
                            PID:1579
                            • /bin/mkdir
                              mkdir -p /usr/bin/bsd-port
                              3⤵
                              • Reads runtime system information
                              PID:1580
                          • /bin/sh
                            sh -c "cp -f /tmp/94156 /usr/bin/bsd-port/knerl"
                            2⤵
                              PID:1581
                              • /bin/cp
                                cp -f /tmp/94156 /usr/bin/bsd-port/knerl
                                3⤵
                                • Write file to user bin folder
                                • Reads runtime system information
                                PID:1582
                            • /bin/sh
                              sh -c /usr/bin/bsd-port/knerl
                              2⤵
                                PID:1584
                                • /usr/bin/bsd-port/knerl
                                  /usr/bin/bsd-port/knerl
                                  3⤵
                                  • Executes dropped EXE
                                  • Modifies init.d
                                  • Write file to user bin folder
                                  • Checks CPU configuration
                                  • Reads system network configuration
                                  • Reads runtime system information
                                  PID:1585
                                  • /bin/sh
                                    sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
                                    4⤵
                                      PID:1591
                                      • /bin/ln
                                        ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
                                        5⤵
                                          PID:1592
                                      • /bin/sh
                                        sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
                                        4⤵
                                          PID:1593
                                          • /bin/ln
                                            ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
                                            5⤵
                                              PID:1594
                                          • /bin/sh
                                            sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
                                            4⤵
                                              PID:1595
                                              • /bin/ln
                                                ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
                                                5⤵
                                                  PID:1596
                                              • /bin/sh
                                                sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
                                                4⤵
                                                  PID:1597
                                                  • /bin/ln
                                                    ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
                                                    5⤵
                                                      PID:1598
                                                  • /bin/sh
                                                    sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
                                                    4⤵
                                                      PID:1599
                                                      • /bin/ln
                                                        ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
                                                        5⤵
                                                          PID:1600
                                                      • /bin/sh
                                                        sh -c "mkdir -p /usr/bin/dpkgd"
                                                        4⤵
                                                          PID:1601
                                                          • /bin/mkdir
                                                            mkdir -p /usr/bin/dpkgd
                                                            5⤵
                                                            • Reads runtime system information
                                                            PID:1602
                                                        • /bin/sh
                                                          sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
                                                          4⤵
                                                            PID:1603
                                                            • /bin/cp
                                                              cp -f /bin/ps /usr/bin/dpkgd/ps
                                                              5⤵
                                                              • Write file to user bin folder
                                                              • Reads runtime system information
                                                              PID:1604
                                                          • /bin/sh
                                                            sh -c "mkdir -p /bin"
                                                            4⤵
                                                              PID:1612
                                                              • /bin/mkdir
                                                                mkdir -p /bin
                                                                5⤵
                                                                • Reads runtime system information
                                                                PID:1613
                                                            • /bin/sh
                                                              sh -c "cp -f /usr/bin/bsd-port/knerl /bin/ps"
                                                              4⤵
                                                                PID:1614
                                                                • /bin/cp
                                                                  cp -f /usr/bin/bsd-port/knerl /bin/ps
                                                                  5⤵
                                                                  • Writes file to system bin folder
                                                                  • Reads runtime system information
                                                                  PID:1615
                                                              • /bin/sh
                                                                sh -c "chmod 0755 /bin/ps"
                                                                4⤵
                                                                  PID:1617
                                                                  • /bin/chmod
                                                                    chmod 0755 /bin/ps
                                                                    5⤵
                                                                      PID:1618
                                                                  • /bin/sh
                                                                    sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
                                                                    4⤵
                                                                      PID:1619
                                                                      • /bin/cp
                                                                        cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
                                                                        5⤵
                                                                        • Write file to user bin folder
                                                                        • Reads runtime system information
                                                                        PID:1620
                                                                    • /bin/sh
                                                                      sh -c "mkdir -p /usr/bin"
                                                                      4⤵
                                                                        PID:1621
                                                                        • /bin/mkdir
                                                                          mkdir -p /usr/bin
                                                                          5⤵
                                                                          • Reads runtime system information
                                                                          PID:1622
                                                                      • /bin/sh
                                                                        sh -c "cp -f /usr/bin/bsd-port/knerl /usr/bin/lsof"
                                                                        4⤵
                                                                          PID:1623
                                                                          • /bin/cp
                                                                            cp -f /usr/bin/bsd-port/knerl /usr/bin/lsof
                                                                            5⤵
                                                                            • Write file to user bin folder
                                                                            • Reads runtime system information
                                                                            PID:1624
                                                                        • /bin/sh
                                                                          sh -c "chmod 0755 /usr/bin/lsof"
                                                                          4⤵
                                                                            PID:1626
                                                                            • /bin/chmod
                                                                              chmod 0755 /usr/bin/lsof
                                                                              5⤵
                                                                                PID:1627
                                                                            • /bin/sh
                                                                              sh -c "insmod /usr/lib/xpacket.ko"
                                                                              4⤵
                                                                                PID:1628
                                                                                • /sbin/insmod
                                                                                  insmod /usr/lib/xpacket.ko
                                                                                  5⤵
                                                                                  • Reads runtime system information
                                                                                  PID:1629
                                                                          • /bin/sh
                                                                            sh -c "mkdir -p /usr/bin"
                                                                            2⤵
                                                                              PID:1587
                                                                              • /bin/mkdir
                                                                                mkdir -p /usr/bin
                                                                                3⤵
                                                                                • Reads runtime system information
                                                                                PID:1588
                                                                            • /bin/sh
                                                                              sh -c "cp -f /tmp/94156 /usr/bin/pythno"
                                                                              2⤵
                                                                                PID:1589
                                                                                • /bin/cp
                                                                                  cp -f /tmp/94156 /usr/bin/pythno
                                                                                  3⤵
                                                                                  • Write file to user bin folder
                                                                                  • Reads runtime system information
                                                                                  PID:1590
                                                                              • /bin/sh
                                                                                sh -c /usr/bin/pythno
                                                                                2⤵
                                                                                  PID:1606
                                                                                  • /usr/bin/pythno
                                                                                    /usr/bin/pythno
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    • Writes file to tmp directory
                                                                                    PID:1607
                                                                                • /bin/sh
                                                                                  sh -c "insmod /usr/lib/xpacket.ko"
                                                                                  2⤵
                                                                                    PID:1609
                                                                                    • /sbin/insmod
                                                                                      insmod /usr/lib/xpacket.ko
                                                                                      3⤵
                                                                                      • Reads runtime system information
                                                                                      PID:1610

                                                                                Network

                                                                                MITRE ATT&CK Matrix ATT&CK v13

                                                                                Initial Access

                                                                                Execution

                                                                                Persistence

                                                                                Boot or Logon Autostart Execution

                                                                                1
                                                                                T1547

                                                                                Hijack Execution Flow

                                                                                2
                                                                                T1574

                                                                                Privilege Escalation

                                                                                Boot or Logon Autostart Execution

                                                                                1
                                                                                T1547

                                                                                Hijack Execution Flow

                                                                                2
                                                                                T1574

                                                                                Defense Evasion

                                                                                Hijack Execution Flow

                                                                                2
                                                                                T1574

                                                                                Virtualization/Sandbox Evasion

                                                                                1
                                                                                T1497

                                                                                Credential Access

                                                                                Discovery

                                                                                System Network Configuration Discovery

                                                                                2
                                                                                T1016

                                                                                Virtualization/Sandbox Evasion

                                                                                1
                                                                                T1497

                                                                                Lateral Movement

                                                                                Collection

                                                                                Exfiltration

                                                                                Command and Control

                                                                                Impact

                                                                                Resource Development

                                                                                Reconnaissance

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • /etc/init.d/VsystemsshMdt
                                                                                  Filesize

                                                                                  23B

                                                                                  MD5

                                                                                  9bbb6a1166b0609335a9aec9ba84eddf

                                                                                  SHA1

                                                                                  57a247f2cfcf3673ff81dd8b94c3da764927451c

                                                                                  SHA256

                                                                                  cb1c6e32a683e01650d11c9ddaebd2815726f59fcdd1612d50a0edc6c2918d6d

                                                                                  SHA512

                                                                                  cab11d7253c1f50b5c0719b26f19b766a20f6731a6867ad3603cd3f89d026037e1497c11c09381e555858c10b39bbd722155c6716d8f64e917be72898ace79ba

                                                                                  Download Submit
                                                                                • /etc/init.d/selinux
                                                                                  Filesize

                                                                                  36B

                                                                                  MD5

                                                                                  caa27b819c9303446f702929874a00e8

                                                                                  SHA1

                                                                                  d24199c0e376edea3f822b215148cc0dc78364bf

                                                                                  SHA256

                                                                                  da9b535a14c6d9152857e211f14fb8da9056e84ba1b8d4dc27ab79c98264050b

                                                                                  SHA512

                                                                                  dcd9413eb2cb24d77f637edfc00ca0bb42229a1a3b0d84e29eff94a7b91aee6ee8c126c286a4b4103e01834d1c6aec9de09ffab3927e8de8015421005f31446e

                                                                                  Download Submit
                                                                                • /tmp/idus.log
                                                                                  Filesize

                                                                                  4B

                                                                                  MD5

                                                                                  faafda66202d234463057972460c04f5

                                                                                  SHA1

                                                                                  b08fff87998d20605f134b632cb8fa3398008116

                                                                                  SHA256

                                                                                  b2382de3cdaaf0c8e505cd370821d7842e493a1e64160dc6991b1109e2938a21

                                                                                  SHA512

                                                                                  2c743b3f56b8ed3295341971cce16d94043522e565ce09214fe8d21ef68d5a1dd355fe97da6770bd856c3241f4d7ced45a17962bda8cf542c0d1f4c17f6fbd7b

                                                                                  Download Submit
                                                                                • /tmp/notify.file
                                                                                  Filesize

                                                                                  10B

                                                                                  MD5

                                                                                  2aa6f0df6171f7a70882ae565ea552e9

                                                                                  SHA1

                                                                                  e28035a12917a231993fbdfbf829630b0f56f196

                                                                                  SHA256

                                                                                  a3efaa09fd6f13fe37590d5059edc3af280c4826b650707546c2f95b271dfd75

                                                                                  SHA512

                                                                                  1c00b642267dac4ef6f78927b2c6dc868289e4f56f00886647939720db228a9aff109770c448a44b21a676a05e5b3e7a093444ab2503e7a1ff616a392630b39d

                                                                                  Download Submit
                                                                                • /tmp/vga.conf
                                                                                  Filesize

                                                                                  4B

                                                                                  MD5

                                                                                  facf9f743b083008a894eee7baa16469

                                                                                  SHA1

                                                                                  fe286d02f80118de47f2226c2fce9f7be0bc04f0

                                                                                  SHA256

                                                                                  2163909115c0f6f1e638bd2c2279387cbe37cc327150a7b5cddfde3d1cd4ef0e

                                                                                  SHA512

                                                                                  7bd3d1d347d68f23d612a3ec7a1d2f4094874162441bae20122876ea980bbb76a3c46d5d2e393975ea0659fb2b58046a311d7660f226482a57a74e9ffd9b0f36

                                                                                  Download Submit
                                                                                • /usr/bin/bsd-port/knerl
                                                                                  Filesize

                                                                                  1.1MB

                                                                                  MD5

                                                                                  7d1343b3ab670b162fb2ce8854f01167

                                                                                  SHA1

                                                                                  de95e608dd0e97d5eca90b6b6d747465980d4857

                                                                                  SHA256

                                                                                  6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23

                                                                                  SHA512

                                                                                  22ff942fcaabe8a63919a53bf68642dd45943ef3c24e558b18d51ca5c4c0209be653ec268f9d0f64b5634e9dd3e32f7eacdb746fd2263907c0f8f33d89dd91be

                                                                                  Download Submit
                                                                                • /usr/bin/dpkgd/lsof
                                                                                  Filesize

                                                                                  159KB

                                                                                  MD5

                                                                                  e093dc78225e2a0a25e3b137c1c1e442

                                                                                  SHA1

                                                                                  c29497cfaae729eb576875e4fdfa400640ab16be

                                                                                  SHA256

                                                                                  1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

                                                                                  SHA512

                                                                                  fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

                                                                                  Download Submit
                                                                                • /usr/bin/dpkgd/ps
                                                                                  Filesize

                                                                                  130KB

                                                                                  MD5

                                                                                  558edc26f8a38fa9788220b9af8a73e7

                                                                                  SHA1

                                                                                  3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

                                                                                  SHA256

                                                                                  b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

                                                                                  SHA512

                                                                                  edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

                                                                                  Download Submit