Overview

overview

10

Static

static

10

6674baf9b5...23.elf

ubuntu-20.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240418-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240418-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    05-05-2024 01:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf

  • Size

    1.1MB

  • MD5

    7d1343b3ab670b162fb2ce8854f01167

  • SHA1

    de95e608dd0e97d5eca90b6b6d747465980d4857

  • SHA256

    6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23

  • SHA512

    22ff942fcaabe8a63919a53bf68642dd45943ef3c24e558b18d51ca5c4c0209be653ec268f9d0f64b5634e9dd3e32f7eacdb746fd2263907c0f8f33d89dd91be

  • SSDEEP

    24576:4vRE7caCfKGPqVEDNLFxKsfawI+gIGYuuCol7r:4vREKfPqVE5jKsfawRHGVo7r

Score
10/10
mrblackantivmbotnetpersistencetrojan

Malware Config

Signatures

  • MrBlack Trojan

    IoT botnet which infects routers to be used for DDoS attacks.

    trojanbotnetmrblack
  • MrBlack trojan 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies init.d 1 TTPs 2 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

  • Write file to user bin folder 1 TTPs 9 IoCs
  • Writes file to system bin folder 1 TTPs 2 IoCs
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 4 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 24 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf
    /tmp/6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf
    1⤵
    • Modifies init.d
    • Reads system routing table
    • Write file to user bin folder
    • Checks CPU configuration
    • Reads system network configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1512
    • /bin/sh
      sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt"
      2⤵
        PID:1914
        • /usr/bin/ln
          ln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt
          3⤵
            PID:1915
        • /bin/sh
          sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt"
          2⤵
            PID:1916
            • /usr/bin/ln
              ln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt
              3⤵
                PID:1917
            • /bin/sh
              sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt"
              2⤵
                PID:1918
                • /usr/bin/ln
                  ln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt
                  3⤵
                    PID:1919
                • /bin/sh
                  sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt"
                  2⤵
                    PID:1920
                    • /usr/bin/ln
                      ln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt
                      3⤵
                        PID:1921
                    • /bin/sh
                      sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt"
                      2⤵
                        PID:1922
                        • /usr/bin/ln
                          ln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt
                          3⤵
                            PID:1923
                        • /bin/sh
                          sh -c "mkdir -p /usr/bin/bsd-port"
                          2⤵
                            PID:1962
                            • /usr/bin/mkdir
                              mkdir -p /usr/bin/bsd-port
                              3⤵
                              • Reads runtime system information
                              PID:1963
                          • /bin/sh
                            sh -c "cp -f /tmp/6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf /usr/bin/bsd-port/knerl"
                            2⤵
                              PID:1964
                              • /usr/bin/cp
                                cp -f /tmp/6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf /usr/bin/bsd-port/knerl
                                3⤵
                                • Write file to user bin folder
                                • Reads runtime system information
                                PID:1965
                            • /bin/sh
                              sh -c /usr/bin/bsd-port/knerl
                              2⤵
                                PID:1979
                                • /usr/bin/bsd-port/knerl
                                  /usr/bin/bsd-port/knerl
                                  3⤵
                                  • Executes dropped EXE
                                  • Modifies init.d
                                  • Write file to user bin folder
                                  • Checks CPU configuration
                                  • Reads system network configuration
                                  • Reads runtime system information
                                  PID:1980
                                  • /bin/sh
                                    sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
                                    4⤵
                                      PID:2016
                                      • /usr/bin/ln
                                        ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
                                        5⤵
                                          PID:2017
                                      • /bin/sh
                                        sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
                                        4⤵
                                          PID:2018
                                          • /usr/bin/ln
                                            ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
                                            5⤵
                                              PID:2019
                                          • /bin/sh
                                            sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
                                            4⤵
                                              PID:2020
                                              • /usr/bin/ln
                                                ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
                                                5⤵
                                                  PID:2021
                                              • /bin/sh
                                                sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
                                                4⤵
                                                  PID:2022
                                                  • /usr/bin/ln
                                                    ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
                                                    5⤵
                                                      PID:2023
                                                  • /bin/sh
                                                    sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
                                                    4⤵
                                                      PID:2024
                                                      • /usr/bin/ln
                                                        ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
                                                        5⤵
                                                          PID:2025
                                                      • /bin/sh
                                                        sh -c "mkdir -p /usr/bin/dpkgd"
                                                        4⤵
                                                          PID:2026
                                                          • /usr/bin/mkdir
                                                            mkdir -p /usr/bin/dpkgd
                                                            5⤵
                                                            • Reads runtime system information
                                                            PID:2027
                                                        • /bin/sh
                                                          sh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"
                                                          4⤵
                                                            PID:2032
                                                            • /usr/bin/cp
                                                              cp -f /bin/lsof /usr/bin/dpkgd/lsof
                                                              5⤵
                                                              • Write file to user bin folder
                                                              • Reads runtime system information
                                                              PID:2033
                                                          • /bin/sh
                                                            sh -c "mkdir -p /bin"
                                                            4⤵
                                                              PID:2036
                                                              • /usr/bin/mkdir
                                                                mkdir -p /bin
                                                                5⤵
                                                                • Reads runtime system information
                                                                PID:2037
                                                            • /bin/sh
                                                              sh -c "cp -f /usr/bin/bsd-port/knerl /bin/lsof"
                                                              4⤵
                                                                PID:2038
                                                                • /usr/bin/cp
                                                                  cp -f /usr/bin/bsd-port/knerl /bin/lsof
                                                                  5⤵
                                                                  • Writes file to system bin folder
                                                                  • Reads runtime system information
                                                                  PID:2039
                                                              • /bin/sh
                                                                sh -c "chmod 0755 /bin/lsof"
                                                                4⤵
                                                                  PID:2040
                                                                  • /usr/bin/chmod
                                                                    chmod 0755 /bin/lsof
                                                                    5⤵
                                                                      PID:2043
                                                                  • /bin/sh
                                                                    sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
                                                                    4⤵
                                                                      PID:2045
                                                                      • /usr/bin/cp
                                                                        cp -f /bin/ps /usr/bin/dpkgd/ps
                                                                        5⤵
                                                                        • Write file to user bin folder
                                                                        • Reads runtime system information
                                                                        PID:2046
                                                                    • /bin/sh
                                                                      sh -c "mkdir -p /bin"
                                                                      4⤵
                                                                        PID:2050
                                                                        • /usr/bin/mkdir
                                                                          mkdir -p /bin
                                                                          5⤵
                                                                          • Reads runtime system information
                                                                          PID:2051
                                                                      • /bin/sh
                                                                        sh -c "cp -f /usr/bin/bsd-port/knerl /bin/ps"
                                                                        4⤵
                                                                          PID:2053
                                                                          • /usr/bin/cp
                                                                            cp -f /usr/bin/bsd-port/knerl /bin/ps
                                                                            5⤵
                                                                            • Writes file to system bin folder
                                                                            • Reads runtime system information
                                                                            PID:2054
                                                                        • /bin/sh
                                                                          sh -c "chmod 0755 /bin/ps"
                                                                          4⤵
                                                                            PID:2055
                                                                            • /usr/bin/chmod
                                                                              chmod 0755 /bin/ps
                                                                              5⤵
                                                                                PID:2056
                                                                            • /bin/sh
                                                                              sh -c "mkdir -p /usr/bin"
                                                                              4⤵
                                                                                PID:2057
                                                                                • /usr/bin/mkdir
                                                                                  mkdir -p /usr/bin
                                                                                  5⤵
                                                                                  • Reads runtime system information
                                                                                  PID:2058
                                                                              • /bin/sh
                                                                                sh -c "cp -f /usr/bin/bsd-port/knerl /usr/bin/lsof"
                                                                                4⤵
                                                                                  PID:2059
                                                                                  • /usr/bin/cp
                                                                                    cp -f /usr/bin/bsd-port/knerl /usr/bin/lsof
                                                                                    5⤵
                                                                                    • Write file to user bin folder
                                                                                    • Reads runtime system information
                                                                                    PID:2060
                                                                                • /bin/sh
                                                                                  sh -c "chmod 0755 /usr/bin/lsof"
                                                                                  4⤵
                                                                                    PID:2061
                                                                                    • /usr/bin/chmod
                                                                                      chmod 0755 /usr/bin/lsof
                                                                                      5⤵
                                                                                        PID:2062
                                                                                    • /bin/sh
                                                                                      sh -c "mkdir -p /usr/bin"
                                                                                      4⤵
                                                                                        PID:2063
                                                                                        • /usr/bin/mkdir
                                                                                          mkdir -p /usr/bin
                                                                                          5⤵
                                                                                          • Reads runtime system information
                                                                                          PID:2064
                                                                                      • /bin/sh
                                                                                        sh -c "cp -f /usr/bin/bsd-port/knerl /usr/bin/ps"
                                                                                        4⤵
                                                                                          PID:2065
                                                                                          • /usr/bin/cp
                                                                                            cp -f /usr/bin/bsd-port/knerl /usr/bin/ps
                                                                                            5⤵
                                                                                            • Write file to user bin folder
                                                                                            • Reads runtime system information
                                                                                            PID:2066
                                                                                        • /bin/sh
                                                                                          sh -c "chmod 0755 /usr/bin/ps"
                                                                                          4⤵
                                                                                            PID:2067
                                                                                            • /usr/bin/chmod
                                                                                              chmod 0755 /usr/bin/ps
                                                                                              5⤵
                                                                                                PID:2068
                                                                                            • /bin/sh
                                                                                              sh -c "insmod /usr/lib/xpacket.ko"
                                                                                              4⤵
                                                                                                PID:2069
                                                                                                • /usr/sbin/insmod
                                                                                                  insmod /usr/lib/xpacket.ko
                                                                                                  5⤵
                                                                                                  • Reads runtime system information
                                                                                                  PID:2070
                                                                                          • /bin/sh
                                                                                            sh -c "mkdir -p /usr/bin"
                                                                                            2⤵
                                                                                              PID:1982
                                                                                              • /usr/bin/mkdir
                                                                                                mkdir -p /usr/bin
                                                                                                3⤵
                                                                                                • Reads runtime system information
                                                                                                PID:1983
                                                                                            • /bin/sh
                                                                                              sh -c "cp -f /tmp/6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf /usr/bin/pythno"
                                                                                              2⤵
                                                                                                PID:1984
                                                                                                • /usr/bin/cp
                                                                                                  cp -f /tmp/6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf /usr/bin/pythno
                                                                                                  3⤵
                                                                                                  • Write file to user bin folder
                                                                                                  • Reads runtime system information
                                                                                                  PID:1985
                                                                                              • /bin/sh
                                                                                                sh -c /usr/bin/pythno
                                                                                                2⤵
                                                                                                  PID:2029
                                                                                                  • /usr/bin/pythno
                                                                                                    /usr/bin/pythno
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Reads runtime system information
                                                                                                    • Writes file to tmp directory
                                                                                                    PID:2030
                                                                                                • /bin/sh
                                                                                                  sh -c "insmod /usr/lib/xpacket.ko"
                                                                                                  2⤵
                                                                                                    PID:2034
                                                                                                    • /usr/sbin/insmod
                                                                                                      insmod /usr/lib/xpacket.ko
                                                                                                      3⤵
                                                                                                      • Reads runtime system information
                                                                                                      PID:2035

                                                                                                Network

                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • /etc/init.d/VsystemsshMdt
                                                                                                  Filesize

                                                                                                  86B

                                                                                                  MD5

                                                                                                  62c50665d16111fd2bd429aee5e844c4

                                                                                                  SHA1

                                                                                                  a20470136573862ad0b81e68d092466cf76f40a6

                                                                                                  SHA256

                                                                                                  81561480ccebeb470642451dbf9e602dd0bc5e6819c1becf3f088e3816149e5b

                                                                                                  SHA512

                                                                                                  afbc70357c51fbc720ee93ae18f301cbcde8eb401618b5371f39e485f733176378f174d8252df39f3b03d2fdd81ca3ae9ddd974f47eb70d07a1d42b8cf4ed36b

                                                                                                  Download Submit

                                                                                                • /etc/init.d/selinux
                                                                                                  Filesize

                                                                                                  36B

                                                                                                  MD5

                                                                                                  caa27b819c9303446f702929874a00e8

                                                                                                  SHA1

                                                                                                  d24199c0e376edea3f822b215148cc0dc78364bf

                                                                                                  SHA256

                                                                                                  da9b535a14c6d9152857e211f14fb8da9056e84ba1b8d4dc27ab79c98264050b

                                                                                                  SHA512

                                                                                                  dcd9413eb2cb24d77f637edfc00ca0bb42229a1a3b0d84e29eff94a7b91aee6ee8c126c286a4b4103e01834d1c6aec9de09ffab3927e8de8015421005f31446e

                                                                                                  Download Submit

                                                                                                • /tmp/idus.log
                                                                                                  Filesize

                                                                                                  4B

                                                                                                  MD5

                                                                                                  88ef51f0bf911e452e8dbb1d807a81ab

                                                                                                  SHA1

                                                                                                  0d0c9e996263c5a31c80793e1718d66c9a924525

                                                                                                  SHA256

                                                                                                  d740238f374425d95f71dcd05dd1486800f0887790b992b74ef41fbb5c8e1167

                                                                                                  SHA512

                                                                                                  9d624fd7ccd3bc7ea769e82615b5404c97e5f4e0e1c55ef888dcf7bc09df03fa9acf38f8cd3f88cafa4697151ea3c6286d797b9c72e89399ac630675d8550a3f

                                                                                                  Download Submit

                                                                                                • /tmp/notify.file
                                                                                                  Filesize

                                                                                                  73B

                                                                                                  MD5

                                                                                                  0400ed517c2462909168771fe1319605

                                                                                                  SHA1

                                                                                                  43fa6a8c8f217caaa72e1a6490d10e1fb5f3c7a2

                                                                                                  SHA256

                                                                                                  1d1c633b317e28b55004bc325b33f4e466d08f26722d9b4618a3bb56971e0d99

                                                                                                  SHA512

                                                                                                  d3535288a9ca00df00b27142fbc00a0f54dc8488830511f9fb3763413639eec71441f748e578e0900c5b0323de6261983f5dc0e34ed38a5b102cca81efc4a29f

                                                                                                  Download Submit

                                                                                                • /tmp/vga.conf
                                                                                                  Filesize

                                                                                                  4B

                                                                                                  MD5

                                                                                                  2b3bf3eee2475e03885a110e9acaab61

                                                                                                  SHA1

                                                                                                  5e540d008531ea36696020361b9ea6561f1f5307

                                                                                                  SHA256

                                                                                                  b695396d3070a538dafaeed76a84fb93d8481fdd7f4672113c5a968130c2e9f4

                                                                                                  SHA512

                                                                                                  7177759d820a4bf738fb164c49f4d43990ea9d983ccb016fedf0e614dd492660e83cda2b31f57a3a342489857255d712a773f691f71dac0c520323e12e117467

                                                                                                  Download Submit

                                                                                                • /usr/bin/bsd-port/knerl
                                                                                                  Filesize

                                                                                                  1.1MB

                                                                                                  MD5

                                                                                                  7d1343b3ab670b162fb2ce8854f01167

                                                                                                  SHA1

                                                                                                  de95e608dd0e97d5eca90b6b6d747465980d4857

                                                                                                  SHA256

                                                                                                  6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23

                                                                                                  SHA512

                                                                                                  22ff942fcaabe8a63919a53bf68642dd45943ef3c24e558b18d51ca5c4c0209be653ec268f9d0f64b5634e9dd3e32f7eacdb746fd2263907c0f8f33d89dd91be

                                                                                                  Download Submit

                                                                                                • /usr/bin/dpkgd/lsof
                                                                                                  Filesize

                                                                                                  171KB

                                                                                                  MD5

                                                                                                  061386937ec7acf924438a2643a32be0

                                                                                                  SHA1

                                                                                                  01a044b9e58839bea3e58c66cb32acc16241bf91

                                                                                                  SHA256

                                                                                                  8a26bbae9eb85aa98ef29cfe5b0a291234db6eb394c3e0c2841983dcf7dda959

                                                                                                  SHA512

                                                                                                  2de2e56ac4c32f47b4a1945ccfb0db378e6d59019ee8004e3e5d2ec8935efb5aa8ee14b8a0b21c61a267e195d42a3232a6dcade8720de06118fd579277f59db7

                                                                                                  Download Submit

                                                                                                • /usr/bin/dpkgd/ps
                                                                                                  Filesize

                                                                                                  134KB

                                                                                                  MD5

                                                                                                  d194576b899af45b1d2a448612ec21e5

                                                                                                  SHA1

                                                                                                  492f7d8f28cd4397ce22fcf0d8bf3304ea93465a

                                                                                                  SHA256

                                                                                                  a8cf81f3a1137c999c3cf336507ce120b3065e633ade01db6280d427b7d986ca

                                                                                                  SHA512

                                                                                                  b323babd9580b91772cde29c9f22ae75b27f5ce8ce0268a48ca41713c3545dd72409932a5c48f6af66ac6e43127eb5461d1f686bd667fa1b0e56a1564db3c539

                                                                                                  Download Submit