Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
23/07/2024, 02:00
Behavioral task
behavioral1
Sample
489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf
Resource
ubuntu2204-amd64-20240522.1-en
General
-
Target
489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf
-
Size
1.2MB
-
MD5
db0533432eb1071c80086e843a2010ec
-
SHA1
f77840fb1fe66b251b8327544bd52f9dd55b32cc
-
SHA256
489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907
-
SHA512
58690d8d6f99f6b30f199b9ec7ce6ee2ec210992fe2b6f159d4c7c45baba772c717d9b771e033b1a65c9ea0a4d66cf10c7d70a783d964fc837d8c556793099e8
-
SSDEEP
24576:e845rGHu6gVJKG75oFpA0VWeX4F2y1q2rJp0:745vRVJKGtSA0VWeosu9p0
Malware Config
Signatures
-
MrBlack trojan 1 IoCs
resource yara_rule behavioral1/files/fstream-4.dat family_mrblack -
Executes dropped EXE 2 IoCs
ioc pid Process /usr/bin/bsd-port/getty 1592 getty /usr/bin/.sshd 1612 .sshd -
description ioc Process File opened for modification /etc/init.d/DbSecuritySpt 489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf File opened for modification /etc/init.d/selinux getty -
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/route 489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf -
Write file to user bin folder 1 TTPs 11 IoCs
description ioc Process File opened for modification /usr/bin/dpkgd/lsof cp File opened for modification /usr/bin/lsof cp File opened for modification /usr/bin/ps cp File opened for modification /usr/bin/bsd-port/getty.lock 489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf File opened for modification /usr/bin/bsd-port/udevd.lock 489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf File opened for modification /usr/bin/bsd-port/getty cp File opened for modification /usr/bin/bsd-port/getty.lock getty File opened for modification /usr/bin/.sshd cp File opened for modification /usr/bin/dpkgd/ps cp File opened for modification /usr/bin/dpkgd/ss cp File opened for modification /usr/bin/ss cp -
Writes file to system bin folder 1 TTPs 3 IoCs
description ioc Process File opened for modification /bin/lsof cp File opened for modification /bin/ps cp File opened for modification /bin/ss cp -
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo 489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf File opened for reading /proc/cpuinfo getty -
Reads system network configuration 1 TTPs 4 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/dev 489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf File opened for reading /proc/net/dev getty File opened for reading /proc/net/route 489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf File opened for reading /proc/net/arp 489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf -
Reads runtime system information 37 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/cmdline insmod File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/sys/kernel/version .sshd File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/stat 489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf File opened for reading /proc/sys/kernel/version 489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/sys/kernel/version getty File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/meminfo 489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf File opened for reading /proc/stat getty File opened for reading /proc/meminfo getty -
Writes file to tmp directory 8 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/gates.lod 489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf File opened for modification /tmp/notify.file 489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf File opened for modification /tmp/moni.lod .sshd File opened for modification /tmp/notify.file .sshd File opened for modification /tmp/conf.n 489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf File opened for modification /tmp/gates.lod .sshd File opened for modification /tmp/moni.lod 489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf File opened for modification /tmp/bill.lock 489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf
Processes
-
/tmp/489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf/tmp/489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf1⤵
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1563 -
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"2⤵PID:1574
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt3⤵PID:1575
-
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"2⤵PID:1576
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt3⤵PID:1577
-
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"2⤵PID:1578
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt3⤵PID:1579
-
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"2⤵PID:1580
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt3⤵PID:1581
-
-
-
/bin/shsh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"2⤵PID:1582
-
/usr/bin/lnln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt3⤵PID:1583
-
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"2⤵PID:1584
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port3⤵
- Reads runtime system information
PID:1585
-
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"2⤵PID:1586
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port3⤵
- Reads runtime system information
PID:1587
-
-
-
/bin/shsh -c "cp -f /tmp/489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf /usr/bin/bsd-port/getty"2⤵PID:1588
-
/usr/bin/cpcp -f /tmp/489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf /usr/bin/bsd-port/getty3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1589
-
-
-
/bin/shsh -c /usr/bin/bsd-port/getty2⤵PID:1591
-
/usr/bin/bsd-port/getty/usr/bin/bsd-port/getty3⤵
- Executes dropped EXE
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
PID:1592 -
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"4⤵PID:1600
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux5⤵PID:1601
-
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"4⤵PID:1602
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux5⤵PID:1603
-
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"4⤵PID:1604
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux5⤵PID:1605
-
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"4⤵PID:1606
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux5⤵PID:1607
-
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"4⤵PID:1608
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux5⤵PID:1609
-
-
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"4⤵PID:1613
-
/usr/bin/mkdirmkdir -p /usr/bin/dpkgd5⤵
- Reads runtime system information
PID:1614
-
-
-
/bin/shsh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"4⤵PID:1615
-
/usr/bin/cpcp -f /bin/lsof /usr/bin/dpkgd/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1616
-
-
-
/bin/shsh -c "mkdir -p /bin"4⤵PID:1617
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1618
-
-
-
/bin/shsh -c "mkdir -p /bin"4⤵PID:1619
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1620
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/lsof"4⤵PID:1621
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /bin/lsof5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1622
-
-
-
/bin/shsh -c "chmod 0755 /bin/lsof"4⤵PID:1623
-
/usr/bin/chmodchmod 0755 /bin/lsof5⤵PID:1624
-
-
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"4⤵PID:1625
-
/usr/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1626
-
-
-
/bin/shsh -c "mkdir -p /bin"4⤵PID:1627
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1628
-
-
-
/bin/shsh -c "mkdir -p /bin"4⤵PID:1629
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1630
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"4⤵PID:1631
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ps5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1632
-
-
-
/bin/shsh -c "chmod 0755 /bin/ps"4⤵PID:1633
-
/usr/bin/chmodchmod 0755 /bin/ps5⤵PID:1634
-
-
-
/bin/shsh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"4⤵PID:1635
-
/usr/bin/cpcp -f /bin/ss /usr/bin/dpkgd/ss5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1636
-
-
-
/bin/shsh -c "mkdir -p /bin"4⤵PID:1637
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1638
-
-
-
/bin/shsh -c "mkdir -p /bin"4⤵PID:1639
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1640
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"4⤵PID:1641
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /bin/ss5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1642
-
-
-
/bin/shsh -c "chmod 0755 /bin/ss"4⤵PID:1643
-
/usr/bin/chmodchmod 0755 /bin/ss5⤵PID:1644
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1645
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1646
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1647
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1648
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"4⤵PID:1649
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1650
-
-
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"4⤵PID:1651
-
/usr/bin/chmodchmod 0755 /usr/bin/lsof5⤵PID:1652
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1653
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1654
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1655
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1656
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ps"4⤵PID:1657
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/ps5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1658
-
-
-
/bin/shsh -c "chmod 0755 /usr/bin/ps"4⤵PID:1659
-
/usr/bin/chmodchmod 0755 /usr/bin/ps5⤵PID:1660
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1663
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1664
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1665
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1666
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ss"4⤵PID:1667
-
/usr/bin/cpcp -f /usr/bin/bsd-port/getty /usr/bin/ss5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1668
-
-
-
/bin/shsh -c "chmod 0755 /usr/bin/ss"4⤵PID:1669
-
/usr/bin/chmodchmod 0755 /usr/bin/ss5⤵PID:1670
-
-
-
/bin/shsh -c "insmod /usr/bin/bsd-port/xpacket.ko"4⤵PID:1673
-
/usr/sbin/insmodinsmod /usr/bin/bsd-port/xpacket.ko5⤵
- Reads runtime system information
PID:1674
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"2⤵PID:1594
-
/usr/bin/mkdirmkdir -p /usr/bin3⤵
- Reads runtime system information
PID:1595
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"2⤵PID:1596
-
/usr/bin/mkdirmkdir -p /usr/bin3⤵
- Reads runtime system information
PID:1597
-
-
-
/bin/shsh -c "cp -f /tmp/489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf /usr/bin/.sshd"2⤵PID:1598
-
/usr/bin/cpcp -f /tmp/489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907.elf /usr/bin/.sshd3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1599
-
-
-
/bin/shsh -c /usr/bin/.sshd2⤵PID:1611
-
/usr/bin/.sshd/usr/bin/.sshd3⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
PID:1612
-
-
-
/bin/shsh -c "insmod /tmp/xpacket.ko"2⤵PID:1671
-
/usr/sbin/insmodinsmod /tmp/xpacket.ko3⤵
- Reads runtime system information
PID:1672
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86B
MD5451e21e24fc29b03a012bbf1943a5a52
SHA19998500fd46b24b0973793fef09ed0d09d49813a
SHA2565bc5e469d336cab422826e74cba47230d9f1d5d02c08fca47d4475d33ceddf20
SHA512b3d131b8e49134f015dfc54717e83df4d7893e9169976dfbfd34322d27a0f6da2181cfb26fc4e59b92a636acf6c284a42b165b932f75857dbd7cf1bf66e20258
-
Filesize
36B
MD5993cc15058142d96c3daf7852c3d5ee8
SHA10950b8b391b04dd3895ea33cd3141543ebd2525d
SHA2568171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
SHA5120c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928
-
Filesize
73B
MD52f476490d525871f51c75f70f7a2adf5
SHA1f21d025557211b0092bb786567cf79d1e8d1e902
SHA25662bfa6cdb05d374d750aae0d479f5a103a29aee4281fdb8971549d1bac5e8b56
SHA512f37a0baee8c0a41a9c4e8bb85c41e0fc06c2201646c25e88318f8e2aa97f3b443af70439d18afeb94b3edf42abfaf5a5f162c9a38047f91e33428c363e36fe42
-
Filesize
4B
MD5facf9f743b083008a894eee7baa16469
SHA1fe286d02f80118de47f2226c2fce9f7be0bc04f0
SHA2562163909115c0f6f1e638bd2c2279387cbe37cc327150a7b5cddfde3d1cd4ef0e
SHA5127bd3d1d347d68f23d612a3ec7a1d2f4094874162441bae20122876ea980bbb76a3c46d5d2e393975ea0659fb2b58046a311d7660f226482a57a74e9ffd9b0f36
-
Filesize
4B
MD57d12b66d3df6af8d429c1a357d8b9e1a
SHA15c5a56a1d11d0a2e27797f751519fa1fdaa28e16
SHA2568429476daf79869660e1228853868ae86ae9ec97893d38ae2be5ac85618d9082
SHA512c877003735c8ad7e442384f40584d4d42b317d4f3e2c0d17d50ac82b4061966995c306c411b5fbb74cb6a0373b1493d3f3bafa4e85ce35a1921d028a4bd322c4
-
Filesize
73B
MD557acc0291cfc6130256fe6b8d29221fa
SHA1d615a7edc7d0f0aa13a6f3d883a78ad2eb7b24e0
SHA256e7dfb6d2efaf97685e57e27c3aa4c42035642b158468b7772c3700fdb9220cc3
SHA5121b2bc04c92952a117003e3128f7544e6eb298a03236dae94087f06c03800e156268cd9ee7603ca8849a20f425a89e2d4a9289061cb0b25b404f8afd35ee0287a
-
Filesize
1.2MB
MD5db0533432eb1071c80086e843a2010ec
SHA1f77840fb1fe66b251b8327544bd52f9dd55b32cc
SHA256489566ae52ff7d91debde176382bc81523bad6bad4b8d1f814576e932d498907
SHA51258690d8d6f99f6b30f199b9ec7ce6ee2ec210992fe2b6f159d4c7c45baba772c717d9b771e033b1a65c9ea0a4d66cf10c7d70a783d964fc837d8c556793099e8
-
Filesize
163KB
MD5ab57b66cc531ae0f996963223e632b60
SHA1bf7e5becd33f21c2539f5a75ffa0ab61c49c8795
SHA2562484863a7bfda7f97b90bfd5dfceed4ec9f27dd51f9c5158c8daabbf4309b1df
SHA512908acef13f3c1d80b7169ec3b16bb67006013453348fff75550bc3c6c2137e798b21d7990edbd5be63d756d9c41b06160aebf38aa80547e4bafa3a62596057f6
-
Filesize
138KB
MD58146139c2ad7e550b1d1f49480997446
SHA1074db8890c3227bd8a588417f5b9bde637bcf3af
SHA256207df9d438f75185ab3af2ab1173d104831a6631c28ef40d38b2ab43de27b40f
SHA512b6d71d537f593b9af833e6f798e412e95fc486a313414ed8cca9639f61be7ac9dca700e9f861c0d07c7f65b3783127a67f829f422472cad8938ba01d397ab9de
-
Filesize
125KB
MD51b25ac945efae8520ba112b500e2d561
SHA18324c4d1d1427829266e82f203386232ff82af15
SHA2565eb16d9a8bc81fe767725874e3f67623b8e86b46ec93546be49c5b09d3ab4636
SHA512e191f967170ea4844f736c5ab75b7bf45fef3af34f0a4bef0d36475d646b0b089449fe39806664b9f6ce1984037687930cc368892230662c8c30f67fa3ac216e