Analysis
-
max time kernel
149s -
max time network
149s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
25-11-2024 18:27
Behavioral task
behavioral1
Sample
a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60
Resource
ubuntu2204-amd64-20240729-en
General
-
Target
a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60
-
Size
1.1MB
-
MD5
f57f99f56834d73211bac97f4ec2dc5c
-
SHA1
314fff2c301fb120ce100e812e3ef4b31580551d
-
SHA256
a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60
-
SHA512
c2785a0b3231ccd5c217f6ec38aa8ca3ece2cc3a3364a3271582ba49cf9ac8a5dfd163765c6284ba72c9bd4e711cc059ba328e6a7ad0b1adeb7e85447b9350a8
-
SSDEEP
24576:4vRE7caCfKGPqVEDNLFxKsfa1I+gIGYuuCol7r:4vREKfPqVE5jKsfa1RHGVo7r
Malware Config
Signatures
-
MrBlack trojan 1 IoCs
Processes:
resource yara_rule /usr/bin/bsd-port/recei family_mrblack -
Mrblack family
-
File and Directory Permissions Modification 1 TTPs 8 IoCs
Adversaries may modify file or directory permissions to evade defenses.
Processes:
chmodshchmodshchmodshchmodshpid process 1630 chmod 1638 sh 1639 chmod 1645 sh 1646 chmod 1652 sh 1653 chmod 1629 sh -
Executes dropped EXE 2 IoCs
Processes:
receioracleioc pid process /usr/bin/bsd-port/recei 1597 recei /usr/bin/oracle 1617 oracle -
Processes:
a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60receidescription ioc process File opened for modification /etc/init.d/VsystemsshMmt a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 File opened for modification /etc/init.d/selinux recei -
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
Processes:
a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60description ioc process File opened for reading /proc/net/route a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 -
Write file to user bin folder 9 IoCs
Processes:
a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60cpcpcpreceicpcpcpdescription ioc process File opened for modification /usr/bin/bsd-port/recei.conf a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 File opened for modification /usr/bin/bsd-port/udevd.conf a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 File opened for modification /usr/bin/bsd-port/recei cp File opened for modification /usr/bin/lsof cp File opened for modification /usr/bin/ps cp File opened for modification /usr/bin/bsd-port/recei.conf recei File opened for modification /usr/bin/oracle cp File opened for modification /usr/bin/dpkgd/lsof cp File opened for modification /usr/bin/dpkgd/ps cp -
Writes file to system bin folder 2 IoCs
Processes:
cpcpdescription ioc process File opened for modification /bin/lsof cp File opened for modification /bin/ps cp -
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60receidescription ioc process File opened for reading /proc/cpuinfo a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 File opened for reading /proc/cpuinfo recei -
Reads system network configuration 1 TTPs 4 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60receidescription ioc process File opened for reading /proc/net/dev a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 File opened for reading /proc/net/dev recei File opened for reading /proc/net/route a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 File opened for reading /proc/net/arp a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 -
Processes:
cpa7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60mkdircpmkdirreceiinsmodmkdirmkdircporacleinsmodmkdircpmkdircpcpmkdircpcpdescription ioc process File opened for reading /proc/filesystems cp File opened for reading /proc/stat a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/meminfo recei File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems mkdir File opened for reading /proc/sys/kernel/version recei File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/sys/kernel/version oracle File opened for reading /proc/meminfo a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 File opened for reading /proc/cmdline insmod File opened for reading /proc/filesystems mkdir File opened for reading /proc/sys/kernel/version a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp File opened for reading /proc/stat recei File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems cp -
Writes file to tmp directory 8 IoCs
Malware often drops required files in the /tmp directory.
Processes:
a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60oracledescription ioc process File opened for modification /tmp/conf.n a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 File opened for modification /tmp/Dest.cfg oracle File opened for modification /tmp/appd.log a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 File opened for modification /tmp/appd.conf a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 File opened for modification /tmp/Dest.cfg a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 File opened for modification /tmp/notify.file a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 File opened for modification /tmp/appd.log oracle File opened for modification /tmp/notify.file oracle
Processes
-
/tmp/a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60/tmp/a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b601⤵
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1569 -
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc1.d/S97VsystemsshMmt"2⤵PID:1581
-
/usr/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc1.d/S97VsystemsshMmt3⤵PID:1582
-
-
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc2.d/S97VsystemsshMmt"2⤵PID:1583
-
/usr/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc2.d/S97VsystemsshMmt3⤵PID:1584
-
-
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc3.d/S97VsystemsshMmt"2⤵PID:1585
-
/usr/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc3.d/S97VsystemsshMmt3⤵PID:1586
-
-
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc4.d/S97VsystemsshMmt"2⤵PID:1587
-
/usr/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc4.d/S97VsystemsshMmt3⤵PID:1588
-
-
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc5.d/S97VsystemsshMmt"2⤵PID:1589
-
/usr/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc5.d/S97VsystemsshMmt3⤵PID:1590
-
-
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"2⤵PID:1591
-
/usr/bin/mkdirmkdir -p /usr/bin/bsd-port3⤵
- Reads runtime system information
PID:1592
-
-
-
/bin/shsh -c "cp -f /tmp/a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 /usr/bin/bsd-port/recei"2⤵PID:1593
-
/usr/bin/cpcp -f /tmp/a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 /usr/bin/bsd-port/recei3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1594
-
-
-
/bin/shsh -c /usr/bin/bsd-port/recei2⤵PID:1596
-
/usr/bin/bsd-port/recei/usr/bin/bsd-port/recei3⤵
- Executes dropped EXE
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
PID:1597 -
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"4⤵PID:1603
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux5⤵PID:1604
-
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"4⤵PID:1605
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux5⤵PID:1606
-
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"4⤵PID:1607
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux5⤵PID:1608
-
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"4⤵PID:1609
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux5⤵PID:1610
-
-
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"4⤵PID:1611
-
/usr/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux5⤵PID:1612
-
-
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"4⤵PID:1613
-
/usr/bin/mkdirmkdir -p /usr/bin/dpkgd5⤵
- Reads runtime system information
PID:1614
-
-
-
/bin/shsh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"4⤵PID:1621
-
/usr/bin/cpcp -f /bin/lsof /usr/bin/dpkgd/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1622
-
-
-
/bin/shsh -c "mkdir -p /bin"4⤵PID:1624
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1625
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/recei /bin/lsof"4⤵PID:1626
-
/usr/bin/cpcp -f /usr/bin/bsd-port/recei /bin/lsof5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1627
-
-
-
/bin/shsh -c "chmod 0755 /bin/lsof"4⤵
- File and Directory Permissions Modification
PID:1629 -
/usr/bin/chmodchmod 0755 /bin/lsof5⤵
- File and Directory Permissions Modification
PID:1630
-
-
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"4⤵PID:1631
-
/usr/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1632
-
-
-
/bin/shsh -c "mkdir -p /bin"4⤵PID:1634
-
/usr/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
PID:1635
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/recei /bin/ps"4⤵PID:1636
-
/usr/bin/cpcp -f /usr/bin/bsd-port/recei /bin/ps5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1637
-
-
-
/bin/shsh -c "chmod 0755 /bin/ps"4⤵
- File and Directory Permissions Modification
PID:1638 -
/usr/bin/chmodchmod 0755 /bin/ps5⤵
- File and Directory Permissions Modification
PID:1639
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1640
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1641
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/recei /usr/bin/lsof"4⤵PID:1642
-
/usr/bin/cpcp -f /usr/bin/bsd-port/recei /usr/bin/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1643
-
-
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"4⤵
- File and Directory Permissions Modification
PID:1645 -
/usr/bin/chmodchmod 0755 /usr/bin/lsof5⤵
- File and Directory Permissions Modification
PID:1646
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵PID:1647
-
/usr/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
PID:1648
-
-
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/recei /usr/bin/ps"4⤵PID:1649
-
/usr/bin/cpcp -f /usr/bin/bsd-port/recei /usr/bin/ps5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1650
-
-
-
/bin/shsh -c "chmod 0755 /usr/bin/ps"4⤵
- File and Directory Permissions Modification
PID:1652 -
/usr/bin/chmodchmod 0755 /usr/bin/ps5⤵
- File and Directory Permissions Modification
PID:1653
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"4⤵PID:1654
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko5⤵
- Reads runtime system information
PID:1655
-
-
-
-
-
/bin/shsh -c "mkdir -p /usr/bin"2⤵PID:1599
-
/usr/bin/mkdirmkdir -p /usr/bin3⤵
- Reads runtime system information
PID:1600
-
-
-
/bin/shsh -c "cp -f /tmp/a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 /usr/bin/oracle"2⤵PID:1601
-
/usr/bin/cpcp -f /tmp/a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 /usr/bin/oracle3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1602
-
-
-
/bin/shsh -c /usr/bin/oracle2⤵PID:1616
-
/usr/bin/oracle/usr/bin/oracle3⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
PID:1617
-
-
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"2⤵PID:1619
-
/usr/sbin/insmodinsmod /usr/lib/xpacket.ko3⤵
- Reads runtime system information
PID:1620
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Privilege Escalation
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD5f90e9abecef631a29abd65e381fafdab
SHA15859bb1f2e934ff5d34ce43f2b88e61e7c860445
SHA25637fbeb68c2552a6439295d755f77145e7f3a0072d9a56a9202ad5eb5d2cd4d14
SHA5125e8f1f072d471437f16f1a10dad33668a11726272b53105f4cdf13ed0ed18d5e32f9cdeb337adc71b32eac5442ac81bbab9e5f08ba92f534190594cbd5173d7e
-
Filesize
36B
MD557cde9c165195cfb90c212057795ed49
SHA1d77d9895306eb09ad9b54588fb7998c79c671563
SHA2563e3488e9c63dfadffd594301e2192418b158238bfb8f83d6702123d72892cf36
SHA512de9af53a508167cbbb820a99c2742918ec5b8c83877b77e43e4b441019311685647f47fb4666ba53ecef4e6a2d5514eb67981d471ddf173b04848609b3c0c00d
-
Filesize
4B
MD57949e456002b28988d38185bd30e77fd
SHA18eac9d03673ad3fa86c1c815275470ec81580e0a
SHA2563a481e728390d89c6843c180dc18ca8d693de5f5421e6240711c5dad483c72b3
SHA51286ffa374c2572cf61c670ec5469b80a9f71db097a87e45393aac98ac96a1c019325f360ccbaa6509acd366045c871b0e2ce76503942603228cf87b5c18105586
-
Filesize
69B
MD50d4750fec88f900553a9e4c96401dc0d
SHA1e10dde0a5028e3fd300fb85b50ff4e0e228eae4a
SHA2564cfb90ff9316f4c96aca3e9bf13ff354de99c6b31bc3451a810a0fffebcfb176
SHA51263ef47b7279afe6bd17028e03f5c124de78dc817fdd4607ffb0a51be0c8c95a76318435b5f0b883d4d20ff54d7f52fbd1877f2952bbfaaeddcc7417f842f840c
-
Filesize
69B
MD5830fecbd08ef05059315cbcad7735639
SHA1a178557cb7efc7e62a28071fdb464e982a8c254b
SHA25683a6029fd731a7c3581fdc37d650d679f934c9944decfffcd786f8cf7e02dfae
SHA51239cd0d035a01c32e9debf33771f56d9afa442f5d5d5365f3b93b84ec11e348321aa4c08a40109cfc520a9c9e8e8d58df64dd233852323eea7ac2a26fe78c8019
-
Filesize
1.1MB
MD5f57f99f56834d73211bac97f4ec2dc5c
SHA1314fff2c301fb120ce100e812e3ef4b31580551d
SHA256a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60
SHA512c2785a0b3231ccd5c217f6ec38aa8ca3ece2cc3a3364a3271582ba49cf9ac8a5dfd163765c6284ba72c9bd4e711cc059ba328e6a7ad0b1adeb7e85447b9350a8
-
Filesize
163KB
MD5ab57b66cc531ae0f996963223e632b60
SHA1bf7e5becd33f21c2539f5a75ffa0ab61c49c8795
SHA2562484863a7bfda7f97b90bfd5dfceed4ec9f27dd51f9c5158c8daabbf4309b1df
SHA512908acef13f3c1d80b7169ec3b16bb67006013453348fff75550bc3c6c2137e798b21d7990edbd5be63d756d9c41b06160aebf38aa80547e4bafa3a62596057f6
-
Filesize
138KB
MD58146139c2ad7e550b1d1f49480997446
SHA1074db8890c3227bd8a588417f5b9bde637bcf3af
SHA256207df9d438f75185ab3af2ab1173d104831a6631c28ef40d38b2ab43de27b40f
SHA512b6d71d537f593b9af833e6f798e412e95fc486a313414ed8cca9639f61be7ac9dca700e9f861c0d07c7f65b3783127a67f829f422472cad8938ba01d397ab9de