mrblack | 646279a6d09af77e39604ccefcf6021752a6572316a91047f0341f08cd8f4d45

Processes:

cpcp6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elfcpknerlcpcpcp

description	ioc	process
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/ps	cp
File opened for modification	/usr/bin/bsd-port/knerl.conf	6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf
File opened for modification	/usr/bin/bsd-port/udevd.conf	6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf
File opened for modification	/usr/bin/bsd-port/knerl	cp
File opened for modification	/usr/bin/bsd-port/knerl.conf	knerl
File opened for modification	/usr/bin/pythno	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow
T1574

Processes:

cpcp

description ioc process

File opened for modification /bin/lsof cp
File opened for modification /bin/ps cp

description	ioc	process
File opened for modification	/bin/lsof	cp
File opened for modification	/bin/ps	cp

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

Processes:

knerl6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf

description	ioc	process
File opened for reading	/proc/cpuinfo	knerl
File opened for reading	/proc/cpuinfo	6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf

Reads system network configuration 1 TTPs 4 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

Processes:

6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elfknerl

description	ioc	process
File opened for reading	/proc/net/dev	6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf
File opened for reading	/proc/net/route	6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf
File opened for reading	/proc/net/arp	6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf
File opened for reading	/proc/net/dev	knerl

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

Processes:

mkdirmkdirknerlmkdircpcpcpcpmkdirpythnoinsmodcp6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elfcpinsmodmkdircpmkdirmkdircp

description	ioc	process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/version	knerl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/version	pythno
File opened for reading	/proc/meminfo	knerl
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/meminfo	6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/version	6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf
File opened for reading	/proc/stat	6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	knerl

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

Processes:

pythno6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf

description	ioc	process
File opened for modification	/tmp/idus.log	pythno
File opened for modification	/tmp/notify.file	pythno
File opened for modification	/tmp/vga.conf	pythno
File opened for modification	/tmp/idus.log	6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf
File opened for modification	/tmp/apsh.conf	6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf
File opened for modification	/tmp/vga.conf	6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf
File opened for modification	/tmp/notify.file	6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf
File opened for modification	/tmp/conf.n	6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf

/tmp/6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf
/tmp/6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf
1⤵
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1487

/bin/sh
sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt"
2⤵
PID:1882

/usr/bin/ln
ln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt
3⤵
PID:1883

/bin/sh
sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt"
2⤵
PID:1884

/usr/bin/ln
ln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt
3⤵
PID:1885

/bin/sh
sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt"
2⤵
PID:1886

/usr/bin/ln
ln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt
3⤵
PID:1887

/bin/sh
sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt"
2⤵
PID:1888

/usr/bin/ln
ln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt
3⤵
PID:1889

/bin/sh
sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt"
2⤵
PID:1890

/usr/bin/ln
ln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt
3⤵
PID:1891

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
2⤵
PID:1892

/usr/bin/mkdir
mkdir -p /usr/bin/bsd-port
3⤵
- Reads runtime system information
PID:1893

/bin/sh
sh -c "cp -f /tmp/6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf /usr/bin/bsd-port/knerl"
2⤵
PID:1894

/usr/bin/cp
cp -f /tmp/6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf /usr/bin/bsd-port/knerl
3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1895

/bin/sh
sh -c /usr/bin/bsd-port/knerl
2⤵
PID:1927

/usr/bin/bsd-port/knerl
/usr/bin/bsd-port/knerl
3⤵
- Executes dropped EXE
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
PID:1928

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
4⤵
PID:1972

/usr/bin/ln
ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
5⤵
PID:1973

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
4⤵
PID:1974

/usr/bin/ln
ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
5⤵
PID:1975

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
4⤵
PID:1976

/usr/bin/ln
ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
5⤵
PID:1977

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
4⤵
PID:1978

/usr/bin/ln
ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
5⤵
PID:1979

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
4⤵
PID:1980

/usr/bin/ln
ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
5⤵
PID:1981

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
4⤵
PID:1982

/usr/bin/mkdir
mkdir -p /usr/bin/dpkgd
5⤵
- Reads runtime system information
PID:1983

/bin/sh
sh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"
4⤵
PID:1988

/usr/bin/cp
cp -f /bin/lsof /usr/bin/dpkgd/lsof
5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1989

/bin/sh
sh -c "mkdir -p /bin"
4⤵
PID:1992

/usr/bin/mkdir
mkdir -p /bin
5⤵
- Reads runtime system information
PID:1993

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/knerl /bin/lsof"
4⤵
PID:1994

/usr/bin/cp
cp -f /usr/bin/bsd-port/knerl /bin/lsof
5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1996

/bin/sh
sh -c "chmod 0755 /bin/lsof"
4⤵
PID:1999

/usr/bin/chmod
chmod 0755 /bin/lsof
5⤵
PID:2000

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
4⤵
PID:2001

/usr/bin/cp
cp -f /bin/ps /usr/bin/dpkgd/ps
5⤵
- Write file to user bin folder
- Reads runtime system information
PID:2003

/bin/sh
sh -c "mkdir -p /bin"
4⤵
PID:2007

/usr/bin/mkdir
mkdir -p /bin
5⤵
- Reads runtime system information
PID:2008

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/knerl /bin/ps"
4⤵
PID:2009

/usr/bin/cp
cp -f /usr/bin/bsd-port/knerl /bin/ps
5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:2010

/bin/sh
sh -c "chmod 0755 /bin/ps"
4⤵
PID:2011

/usr/bin/chmod
chmod 0755 /bin/ps
5⤵
PID:2012

/bin/sh
sh -c "mkdir -p /usr/bin"
4⤵
PID:2013

/usr/bin/mkdir
mkdir -p /usr/bin
5⤵
- Reads runtime system information
PID:2014

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/knerl /usr/bin/lsof"
4⤵
PID:2015

/usr/bin/cp
cp -f /usr/bin/bsd-port/knerl /usr/bin/lsof
5⤵
- Write file to user bin folder
- Reads runtime system information
PID:2016

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
4⤵
PID:2017

/usr/bin/chmod
chmod 0755 /usr/bin/lsof
5⤵
PID:2018

/bin/sh
sh -c "mkdir -p /usr/bin"
4⤵
PID:2019

/usr/bin/mkdir
mkdir -p /usr/bin
5⤵
- Reads runtime system information
PID:2020

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/knerl /usr/bin/ps"
4⤵
PID:2021

/usr/bin/cp
cp -f /usr/bin/bsd-port/knerl /usr/bin/ps
5⤵
- Write file to user bin folder
- Reads runtime system information
PID:2022

/bin/sh
sh -c "chmod 0755 /usr/bin/ps"
4⤵
PID:2023

/usr/bin/chmod
chmod 0755 /usr/bin/ps
5⤵
PID:2024

/bin/sh
sh -c "insmod /usr/lib/xpacket.ko"
4⤵
PID:2025

/usr/sbin/insmod
insmod /usr/lib/xpacket.ko
5⤵
- Reads runtime system information
PID:2026

/bin/sh
sh -c "mkdir -p /usr/bin"
2⤵
PID:1930

/usr/bin/mkdir
mkdir -p /usr/bin
3⤵
- Reads runtime system information
PID:1931

/bin/sh
sh -c "cp -f /tmp/6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf /usr/bin/pythno"
2⤵
PID:1932

/usr/bin/cp
cp -f /tmp/6674baf9b5ee9baf415ae92ed69b522bf1367cceb60cfd57ae7bc4b8e0677a23.elf /usr/bin/pythno
3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1933

/bin/sh
sh -c /usr/bin/pythno
2⤵
PID:1985

/usr/bin/pythno
/usr/bin/pythno
3⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
PID:1986

/bin/sh
sh -c "insmod /usr/lib/xpacket.ko"
2⤵
PID:1990

/usr/sbin/insmod
insmod /usr/lib/xpacket.ko
3⤵
- Reads runtime system information
PID:1991

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion