Analysis
-
max time kernel
149s -
max time network
149s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
19-07-2024 14:07
Behavioral task
behavioral1
Sample
ff.elf
Resource
ubuntu2204-amd64-20240522.1-en
General
-
Target
ff.elf
-
Size
1.2MB
-
MD5
8bd5139f9d5473e0c09c3cf4ba2b0271
-
SHA1
045f769ebe934a36d4540eb70241e8f4ae9bbc22
-
SHA256
f111237d031ac98043fab31936e5782073e6ac72b4d4e50d3b39d682702fda27
-
SHA512
1dbf99c0315955dba1d515c113de0a0a511bfe28f769425706529f71fb5f356fe22d0579c2a1b3cf79a759f2537eb1cdaa44280e910df3771cb2281a6f5d1d9c
-
SSDEEP
24576:e845rGHu6gVJKG75oFpA0VWeX4D2y1q2rJp0:745vRVJKGtSA0VWeoiu9p0
Malware Config
Signatures
-
MrBlack trojan 1 IoCs
Processes:
resource yara_rule /usr/bin/bsd-port/getty family_mrblack -
Executes dropped EXE 2 IoCs
Processes:
getty.sshdioc pid process /usr/bin/bsd-port/getty 1600 getty /usr/bin/.sshd 1624 .sshd -
Processes:
ff.elfgettydescription ioc process File opened for modification /etc/init.d/DbSecuritySpt ff.elf File opened for modification /etc/init.d/selinux getty -
Reads system routing table 1 TTPs 2 IoCs
Gets active network interfaces from /proc virtual filesystem.
Processes:
gettyff.elfdescription ioc process File opened for reading /proc/net/route getty File opened for reading /proc/net/route ff.elf -
Write file to user bin folder 1 TTPs 12 IoCs
Processes:
cpff.elfcpcpcpcpcpgettycpcpdescription ioc process File opened for modification /usr/bin/ss cp File opened for modification /usr/bin/bsd-port/udevd.lock ff.elf File opened for modification /usr/bin/bsd-port/getty cp File opened for modification /usr/bin/.sshd cp File opened for modification /usr/bin/dpkgd/ps cp File opened for modification /usr/bin/dpkgd/ss cp File opened for modification /usr/bin/ps cp File opened for modification /usr/bin/bsd-port/getty.lock ff.elf File opened for modification /usr/bin/bsd-port/getty.lock getty File opened for modification /usr/bin/dpkgd/lsof cp File opened for modification /usr/bin/lsof cp File opened for modification /usr/bin/bsd-port/conf.n getty -
Writes file to system bin folder 1 TTPs 3 IoCs
Processes:
cpcpcpdescription ioc process File opened for modification /bin/lsof cp File opened for modification /bin/ps cp File opened for modification /bin/ss cp -
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
gettyff.elfdescription ioc process File opened for reading /proc/cpuinfo getty File opened for reading /proc/cpuinfo ff.elf -
Reads system network configuration 1 TTPs 6 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
gettyff.elfdescription ioc process File opened for reading /proc/net/arp getty File opened for reading /proc/net/route ff.elf File opened for reading /proc/net/arp ff.elf File opened for reading /proc/net/dev getty File opened for reading /proc/net/dev ff.elf File opened for reading /proc/net/route getty -
Reads runtime system information 37 IoCs
Reads data from /proc virtual filesystem.
Processes:
mkdirff.elfinsmodcpmkdirmkdir.sshdmkdircpmkdircpmkdircpinsmodgettycpmkdircpmkdircpcpmkdircpmkdirmkdirmkdirmkdirmkdirmkdircpcpmkdirmkdirdescription ioc process File opened for reading /proc/filesystems mkdir File opened for reading /proc/stat ff.elf File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/sys/kernel/version .sshd File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/cmdline insmod File opened for reading /proc/sys/kernel/version ff.elf File opened for reading /proc/sys/kernel/version getty File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/stat getty File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/meminfo getty File opened for reading /proc/meminfo ff.elf File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir -
Writes file to tmp directory 8 IoCs
Malware often drops required files in the /tmp directory.
Processes:
ff.elf.sshddescription ioc process File opened for modification /tmp/moni.lod ff.elf File opened for modification /tmp/bill.lock ff.elf File opened for modification /tmp/gates.lod ff.elf File opened for modification /tmp/notify.file ff.elf File opened for modification /tmp/moni.lod .sshd File opened for modification /tmp/notify.file .sshd File opened for modification /tmp/conf.n ff.elf File opened for modification /tmp/gates.lod .sshd
Processes
-
/tmp/ff.elf/tmp/ff.elf1⤵
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1570 -
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"2⤵PID:1582
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt3⤵PID:1583
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"2⤵PID:1584
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt3⤵PID:1585
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"2⤵PID:1586
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt3⤵PID:1587
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"2⤵PID:1588
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt3⤵PID:1589
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"2⤵PID:1590
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt3⤵PID:1591
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"2⤵PID:1592
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port3⤵
- Reads runtime system information
PID:1593 -
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"2⤵PID:1594
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port3⤵
- Reads runtime system information
PID:1595 -
/bin/shsh -c "cp -f /tmp/ff.elf /usr/bin/bsd-port/getty"2⤵PID:1596
-
/usr/bin/cpcp -f /tmp/ff.elf /usr/bin/bsd-port/getty3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1597 -
/bin/shsh -c /usr/bin/bsd-port/getty2⤵PID:1599
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty3⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
PID:1600 -
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"4⤵PID:1608
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux5⤵PID:1609
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"4⤵PID:1610
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux5⤵PID:1611
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"4⤵PID:1612
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux5⤵PID:1613
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"4⤵PID:1614
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux5⤵PID:1615
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"4⤵PID:1616
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux5⤵PID:1617
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"4⤵PID:1618
-
/usr/bin/mkdirmkdir -p /usr/bin/dpkgd5⤵
- Reads runtime system information
PID:1619 -
/bin/shsh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"4⤵PID:1620
-
/usr/bin/cpcp -f /bin/lsof /usr/bin/dpkgd/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1621 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1625
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1626 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1627
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1628 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/lsof"4⤵PID:1629
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /bin/lsof5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1630 -
/bin/shsh -c "chmod 0755 /bin/lsof"4⤵PID:1631
-
/usr/bin/chmodchmod 0755 /bin/lsof5⤵PID:1632
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"4⤵PID:1633
-
/usr/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1634 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1635
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1636 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1637
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1638 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"4⤵PID:1639
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ps5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1640 -
/bin/shsh -c "chmod 0755 /bin/ps"4⤵PID:1641
-
/usr/bin/chmodchmod 0755 /bin/ps5⤵PID:1642
-
/bin/shsh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"4⤵PID:1643
-
/usr/bin/cpcp -f /bin/ss /usr/bin/dpkgd/ss5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1644 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1645
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1646 -
/bin/shsh -c "mkdir -p /bin"4⤵PID:1647
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1648 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"4⤵PID:1649
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ss5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1650 -
/bin/shsh -c "chmod 0755 /bin/ss"4⤵PID:1651
-
/usr/bin/chmodchmod 0755 /bin/ss5⤵PID:1652
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1653
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1654 -
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1655
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1656 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"4⤵PID:1657
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1658 -
/bin/shsh -c "chmod 0755 /usr/bin/lsof"4⤵PID:1659
-
/usr/bin/chmodchmod 0755 /usr/bin/lsof5⤵PID:1660
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1661
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1662 -
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1663
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1664 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ps"4⤵PID:1665
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/ps5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1666 -
/bin/shsh -c "chmod 0755 /usr/bin/ps"4⤵PID:1667
-
/usr/bin/chmodchmod 0755 /usr/bin/ps5⤵PID:1668
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1669
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1670 -
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1671
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1672 -
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ss"4⤵PID:1673
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/ss5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1674 -
/bin/shsh -c "chmod 0755 /usr/bin/ss"4⤵PID:1675
-
/usr/bin/chmodchmod 0755 /usr/bin/ss5⤵PID:1676
-
/bin/shsh -c "insmod /usr/bin/bsd-port/xpacket.ko"4⤵PID:1679
-
/usr/sbin/insmodinsmod /usr/bin/bsd-port/xpacket.ko5⤵
- Reads runtime system information
PID:1680 -
/bin/shsh -c "mkdir -p /usr/bin"2⤵PID:1602
-
/usr/bin/mkdirmkdir -p /usr/bin3⤵
- Reads runtime system information
PID:1603 -
/bin/shsh -c "mkdir -p /usr/bin"2⤵PID:1604
-
/usr/bin/mkdirmkdir -p /usr/bin3⤵
- Reads runtime system information
PID:1605 -
/bin/shsh -c "cp -f /tmp/ff.elf /usr/bin/.sshd"2⤵PID:1606
-
/usr/bin/cpcp -f /tmp/ff.elf /usr/bin/.sshd3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1607 -
/bin/shsh -c /usr/bin/.sshd2⤵PID:1623
-
/usr/bin/.sshd/usr/bin/.sshd3⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
PID:1624 -
/bin/shsh -c "insmod /tmp/xpacket.ko"2⤵PID:1681
-
/usr/sbin/insmodinsmod /tmp/xpacket.ko3⤵
- Reads runtime system information
PID:1682
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24B
MD5c422b46574f0b10884fbc2821fa09520
SHA1e84a07751c600125e76dbcacedc21415d13034b2
SHA256529501fda4142ebe7242811610eed3979db0fdabd9988f0a078915e8916f4d31
SHA512a947802a23dd51bee7dfb7e2081c4a80f52e34b3b028e1a0e082cca9c6415db513adc8b33810bb69f7b9f3433c273ac0c1d186655194f35e4c11004b6fa334d4
-
Filesize
36B
MD5993cc15058142d96c3daf7852c3d5ee8
SHA10950b8b391b04dd3895ea33cd3141543ebd2525d
SHA2568171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
SHA5120c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928
-
Filesize
4B
MD57bd28f15a49d5e5848d6ec70e584e625
SHA1d2fce7d4fae7323ea1b94f177e0a41a42fe0dd09
SHA256aded40e220d2587b0ef1f88302a192d411bc55ddff1c4d818177777d6060a490
SHA512f0ce80170e4bfc2929af244040c4d5dd5d317e80d3cac9883f162e55478b9825d07aa9114b8bb48f74fe28396ee02a2c59710b9d1109b6456ce4593cb1659d67
-
Filesize
4B
MD508e6bea8e90ba87af3c9554d94db6579
SHA1f6c851b89dddaf2314c44b0b0fd3f7f70784fcbb
SHA25688b82308d570d71f02c5aa6a14ffe29a7ffbe14969a63094eb19e8e34256d9bf
SHA5121771fa59c930ca0a37335569539bce0e096a772b0413eb5a34894e536360c633a6df469e76393765013adda49dd394e67b9f2a17f529c8c684d2ce447343f085
-
Filesize
11B
MD5fc5e8e7f924af7accbf0441f935ab11a
SHA1ebb17c2120f3b3c045db116e985764290d305bf2
SHA25655128c6dd463e99babbdff60bbc04c7a7edae159e209ee555154269ebd19f65f
SHA512139bf33f89fbe83537e06b7fc35bc0ad8fb90443151574360eac8e9546410f48e2b0cd650682724757baa53ac42274979baa136af07557616d61db17e09d7f23
-
Filesize
73B
MD58661c3d82087b57220bb817c06c7ab1e
SHA1ed09895f54a3020552882e0d01975d868fd62187
SHA256e364d0737fc2c1f96c0f4e3cb002c24daac056f861a9f4c1c359977efd4f148a
SHA512af5eec9a17188a4be2c77257dc0ef47012a41612f3c73c11f8e3588c7cc528181cc877d8101066f2ebe47c97a9afcbd999c8215748a8aa940aa88d65ff51f6a5
-
Filesize
1.2MB
MD58bd5139f9d5473e0c09c3cf4ba2b0271
SHA1045f769ebe934a36d4540eb70241e8f4ae9bbc22
SHA256f111237d031ac98043fab31936e5782073e6ac72b4d4e50d3b39d682702fda27
SHA5121dbf99c0315955dba1d515c113de0a0a511bfe28f769425706529f71fb5f356fe22d0579c2a1b3cf79a759f2537eb1cdaa44280e910df3771cb2281a6f5d1d9c
-
Filesize
163KB
MD5ab57b66cc531ae0f996963223e632b60
SHA1bf7e5becd33f21c2539f5a75ffa0ab61c49c8795
SHA2562484863a7bfda7f97b90bfd5dfceed4ec9f27dd51f9c5158c8daabbf4309b1df
SHA512908acef13f3c1d80b7169ec3b16bb67006013453348fff75550bc3c6c2137e798b21d7990edbd5be63d756d9c41b06160aebf38aa80547e4bafa3a62596057f6
-
Filesize
138KB
MD58146139c2ad7e550b1d1f49480997446
SHA1074db8890c3227bd8a588417f5b9bde637bcf3af
SHA256207df9d438f75185ab3af2ab1173d104831a6631c28ef40d38b2ab43de27b40f
SHA512b6d71d537f593b9af833e6f798e412e95fc486a313414ed8cca9639f61be7ac9dca700e9f861c0d07c7f65b3783127a67f829f422472cad8938ba01d397ab9de
-
Filesize
125KB
MD51b25ac945efae8520ba112b500e2d561
SHA18324c4d1d1427829266e82f203386232ff82af15
SHA2565eb16d9a8bc81fe767725874e3f67623b8e86b46ec93546be49c5b09d3ab4636
SHA512e191f967170ea4844f736c5ab75b7bf45fef3af34f0a4bef0d36475d646b0b089449fe39806664b9f6ce1984037687930cc368892230662c8c30f67fa3ac216e