Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240729-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    25-11-2024 18:27

General

  • Target

    a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60

  • Size

    1.1MB

  • MD5

    f57f99f56834d73211bac97f4ec2dc5c

  • SHA1

    314fff2c301fb120ce100e812e3ef4b31580551d

  • SHA256

    a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60

  • SHA512

    c2785a0b3231ccd5c217f6ec38aa8ca3ece2cc3a3364a3271582ba49cf9ac8a5dfd163765c6284ba72c9bd4e711cc059ba328e6a7ad0b1adeb7e85447b9350a8

  • SSDEEP

    24576:4vRE7caCfKGPqVEDNLFxKsfa1I+gIGYuuCol7r:4vREKfPqVE5jKsfa1RHGVo7r

Malware Config

Signatures

  • MrBlack Trojan

    IoT botnet which infects routers to be used for DDoS attacks.

  • MrBlack trojan 1 IoCs
  • Mrblack family
  • File and Directory Permissions Modification 1 TTPs 8 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

  • Executes dropped EXE 2 IoCs
  • Modifies init.d 2 TTPs 2 IoCs

    Adds/modifies system service, likely for persistence.

  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

  • Write file to user bin folder 9 IoCs
  • Writes file to system bin folder 2 IoCs
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads system network configuration 1 TTPs 4 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 24 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60
    /tmp/a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60
    1⤵
    • Modifies init.d
    • Reads system routing table
    • Write file to user bin folder
    • Checks CPU configuration
    • Reads system network configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1569
    • /bin/sh
      sh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc1.d/S97VsystemsshMmt"
      2⤵
        PID:1581
        • /usr/bin/ln
          ln -s /etc/init.d/VsystemsshMmt /etc/rc1.d/S97VsystemsshMmt
          3⤵
            PID:1582
        • /bin/sh
          sh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc2.d/S97VsystemsshMmt"
          2⤵
            PID:1583
            • /usr/bin/ln
              ln -s /etc/init.d/VsystemsshMmt /etc/rc2.d/S97VsystemsshMmt
              3⤵
                PID:1584
            • /bin/sh
              sh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc3.d/S97VsystemsshMmt"
              2⤵
                PID:1585
                • /usr/bin/ln
                  ln -s /etc/init.d/VsystemsshMmt /etc/rc3.d/S97VsystemsshMmt
                  3⤵
                    PID:1586
                • /bin/sh
                  sh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc4.d/S97VsystemsshMmt"
                  2⤵
                    PID:1587
                    • /usr/bin/ln
                      ln -s /etc/init.d/VsystemsshMmt /etc/rc4.d/S97VsystemsshMmt
                      3⤵
                        PID:1588
                    • /bin/sh
                      sh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc5.d/S97VsystemsshMmt"
                      2⤵
                        PID:1589
                        • /usr/bin/ln
                          ln -s /etc/init.d/VsystemsshMmt /etc/rc5.d/S97VsystemsshMmt
                          3⤵
                            PID:1590
                        • /bin/sh
                          sh -c "mkdir -p /usr/bin/bsd-port"
                          2⤵
                            PID:1591
                            • /usr/bin/mkdir
                              mkdir -p /usr/bin/bsd-port
                              3⤵
                              • Reads runtime system information
                              PID:1592
                          • /bin/sh
                            sh -c "cp -f /tmp/a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 /usr/bin/bsd-port/recei"
                            2⤵
                              PID:1593
                              • /usr/bin/cp
                                cp -f /tmp/a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 /usr/bin/bsd-port/recei
                                3⤵
                                • Write file to user bin folder
                                • Reads runtime system information
                                PID:1594
                            • /bin/sh
                              sh -c /usr/bin/bsd-port/recei
                              2⤵
                                PID:1596
                                • /usr/bin/bsd-port/recei
                                  /usr/bin/bsd-port/recei
                                  3⤵
                                  • Executes dropped EXE
                                  • Modifies init.d
                                  • Write file to user bin folder
                                  • Checks CPU configuration
                                  • Reads system network configuration
                                  • Reads runtime system information
                                  PID:1597
                                  • /bin/sh
                                    sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
                                    4⤵
                                      PID:1603
                                      • /usr/bin/ln
                                        ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
                                        5⤵
                                          PID:1604
                                      • /bin/sh
                                        sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
                                        4⤵
                                          PID:1605
                                          • /usr/bin/ln
                                            ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
                                            5⤵
                                              PID:1606
                                          • /bin/sh
                                            sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
                                            4⤵
                                              PID:1607
                                              • /usr/bin/ln
                                                ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
                                                5⤵
                                                  PID:1608
                                              • /bin/sh
                                                sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
                                                4⤵
                                                  PID:1609
                                                  • /usr/bin/ln
                                                    ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
                                                    5⤵
                                                      PID:1610
                                                  • /bin/sh
                                                    sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
                                                    4⤵
                                                      PID:1611
                                                      • /usr/bin/ln
                                                        ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
                                                        5⤵
                                                          PID:1612
                                                      • /bin/sh
                                                        sh -c "mkdir -p /usr/bin/dpkgd"
                                                        4⤵
                                                          PID:1613
                                                          • /usr/bin/mkdir
                                                            mkdir -p /usr/bin/dpkgd
                                                            5⤵
                                                            • Reads runtime system information
                                                            PID:1614
                                                        • /bin/sh
                                                          sh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"
                                                          4⤵
                                                            PID:1621
                                                            • /usr/bin/cp
                                                              cp -f /bin/lsof /usr/bin/dpkgd/lsof
                                                              5⤵
                                                              • Write file to user bin folder
                                                              • Reads runtime system information
                                                              PID:1622
                                                          • /bin/sh
                                                            sh -c "mkdir -p /bin"
                                                            4⤵
                                                              PID:1624
                                                              • /usr/bin/mkdir
                                                                mkdir -p /bin
                                                                5⤵
                                                                • Reads runtime system information
                                                                PID:1625
                                                            • /bin/sh
                                                              sh -c "cp -f /usr/bin/bsd-port/recei /bin/lsof"
                                                              4⤵
                                                                PID:1626
                                                                • /usr/bin/cp
                                                                  cp -f /usr/bin/bsd-port/recei /bin/lsof
                                                                  5⤵
                                                                  • Writes file to system bin folder
                                                                  • Reads runtime system information
                                                                  PID:1627
                                                              • /bin/sh
                                                                sh -c "chmod 0755 /bin/lsof"
                                                                4⤵
                                                                • File and Directory Permissions Modification
                                                                PID:1629
                                                                • /usr/bin/chmod
                                                                  chmod 0755 /bin/lsof
                                                                  5⤵
                                                                  • File and Directory Permissions Modification
                                                                  PID:1630
                                                              • /bin/sh
                                                                sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
                                                                4⤵
                                                                  PID:1631
                                                                  • /usr/bin/cp
                                                                    cp -f /bin/ps /usr/bin/dpkgd/ps
                                                                    5⤵
                                                                    • Write file to user bin folder
                                                                    • Reads runtime system information
                                                                    PID:1632
                                                                • /bin/sh
                                                                  sh -c "mkdir -p /bin"
                                                                  4⤵
                                                                    PID:1634
                                                                    • /usr/bin/mkdir
                                                                      mkdir -p /bin
                                                                      5⤵
                                                                      • Reads runtime system information
                                                                      PID:1635
                                                                  • /bin/sh
                                                                    sh -c "cp -f /usr/bin/bsd-port/recei /bin/ps"
                                                                    4⤵
                                                                      PID:1636
                                                                      • /usr/bin/cp
                                                                        cp -f /usr/bin/bsd-port/recei /bin/ps
                                                                        5⤵
                                                                        • Writes file to system bin folder
                                                                        • Reads runtime system information
                                                                        PID:1637
                                                                    • /bin/sh
                                                                      sh -c "chmod 0755 /bin/ps"
                                                                      4⤵
                                                                      • File and Directory Permissions Modification
                                                                      PID:1638
                                                                      • /usr/bin/chmod
                                                                        chmod 0755 /bin/ps
                                                                        5⤵
                                                                        • File and Directory Permissions Modification
                                                                        PID:1639
                                                                    • /bin/sh
                                                                      sh -c "mkdir -p /usr/bin"
                                                                      4⤵
                                                                        PID:1640
                                                                        • /usr/bin/mkdir
                                                                          mkdir -p /usr/bin
                                                                          5⤵
                                                                          • Reads runtime system information
                                                                          PID:1641
                                                                      • /bin/sh
                                                                        sh -c "cp -f /usr/bin/bsd-port/recei /usr/bin/lsof"
                                                                        4⤵
                                                                          PID:1642
                                                                          • /usr/bin/cp
                                                                            cp -f /usr/bin/bsd-port/recei /usr/bin/lsof
                                                                            5⤵
                                                                            • Write file to user bin folder
                                                                            • Reads runtime system information
                                                                            PID:1643
                                                                        • /bin/sh
                                                                          sh -c "chmod 0755 /usr/bin/lsof"
                                                                          4⤵
                                                                          • File and Directory Permissions Modification
                                                                          PID:1645
                                                                          • /usr/bin/chmod
                                                                            chmod 0755 /usr/bin/lsof
                                                                            5⤵
                                                                            • File and Directory Permissions Modification
                                                                            PID:1646
                                                                        • /bin/sh
                                                                          sh -c "mkdir -p /usr/bin"
                                                                          4⤵
                                                                            PID:1647
                                                                            • /usr/bin/mkdir
                                                                              mkdir -p /usr/bin
                                                                              5⤵
                                                                              • Reads runtime system information
                                                                              PID:1648
                                                                          • /bin/sh
                                                                            sh -c "cp -f /usr/bin/bsd-port/recei /usr/bin/ps"
                                                                            4⤵
                                                                              PID:1649
                                                                              • /usr/bin/cp
                                                                                cp -f /usr/bin/bsd-port/recei /usr/bin/ps
                                                                                5⤵
                                                                                • Write file to user bin folder
                                                                                • Reads runtime system information
                                                                                PID:1650
                                                                            • /bin/sh
                                                                              sh -c "chmod 0755 /usr/bin/ps"
                                                                              4⤵
                                                                              • File and Directory Permissions Modification
                                                                              PID:1652
                                                                              • /usr/bin/chmod
                                                                                chmod 0755 /usr/bin/ps
                                                                                5⤵
                                                                                • File and Directory Permissions Modification
                                                                                PID:1653
                                                                            • /bin/sh
                                                                              sh -c "insmod /usr/lib/xpacket.ko"
                                                                              4⤵
                                                                                PID:1654
                                                                                • /usr/sbin/insmod
                                                                                  insmod /usr/lib/xpacket.ko
                                                                                  5⤵
                                                                                  • Reads runtime system information
                                                                                  PID:1655
                                                                          • /bin/sh
                                                                            sh -c "mkdir -p /usr/bin"
                                                                            2⤵
                                                                              PID:1599
                                                                              • /usr/bin/mkdir
                                                                                mkdir -p /usr/bin
                                                                                3⤵
                                                                                • Reads runtime system information
                                                                                PID:1600
                                                                            • /bin/sh
                                                                              sh -c "cp -f /tmp/a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 /usr/bin/oracle"
                                                                              2⤵
                                                                                PID:1601
                                                                                • /usr/bin/cp
                                                                                  cp -f /tmp/a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60 /usr/bin/oracle
                                                                                  3⤵
                                                                                  • Write file to user bin folder
                                                                                  • Reads runtime system information
                                                                                  PID:1602
                                                                              • /bin/sh
                                                                                sh -c /usr/bin/oracle
                                                                                2⤵
                                                                                  PID:1616
                                                                                  • /usr/bin/oracle
                                                                                    /usr/bin/oracle
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    • Reads runtime system information
                                                                                    • Writes file to tmp directory
                                                                                    PID:1617
                                                                                • /bin/sh
                                                                                  sh -c "insmod /usr/lib/xpacket.ko"
                                                                                  2⤵
                                                                                    PID:1619
                                                                                    • /usr/sbin/insmod
                                                                                      insmod /usr/lib/xpacket.ko
                                                                                      3⤵
                                                                                      • Reads runtime system information
                                                                                      PID:1620

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • /etc/init.d/VsystemsshMmt

                                                                                  Filesize

                                                                                  82B

                                                                                  MD5

                                                                                  f90e9abecef631a29abd65e381fafdab

                                                                                  SHA1

                                                                                  5859bb1f2e934ff5d34ce43f2b88e61e7c860445

                                                                                  SHA256

                                                                                  37fbeb68c2552a6439295d755f77145e7f3a0072d9a56a9202ad5eb5d2cd4d14

                                                                                  SHA512

                                                                                  5e8f1f072d471437f16f1a10dad33668a11726272b53105f4cdf13ed0ed18d5e32f9cdeb337adc71b32eac5442ac81bbab9e5f08ba92f534190594cbd5173d7e

                                                                                • /etc/init.d/selinux

                                                                                  Filesize

                                                                                  36B

                                                                                  MD5

                                                                                  57cde9c165195cfb90c212057795ed49

                                                                                  SHA1

                                                                                  d77d9895306eb09ad9b54588fb7998c79c671563

                                                                                  SHA256

                                                                                  3e3488e9c63dfadffd594301e2192418b158238bfb8f83d6702123d72892cf36

                                                                                  SHA512

                                                                                  de9af53a508167cbbb820a99c2742918ec5b8c83877b77e43e4b441019311685647f47fb4666ba53ecef4e6a2d5514eb67981d471ddf173b04848609b3c0c00d

                                                                                • /tmp/Dest.cfg

                                                                                  Filesize

                                                                                  4B

                                                                                  MD5

                                                                                  7949e456002b28988d38185bd30e77fd

                                                                                  SHA1

                                                                                  8eac9d03673ad3fa86c1c815275470ec81580e0a

                                                                                  SHA256

                                                                                  3a481e728390d89c6843c180dc18ca8d693de5f5421e6240711c5dad483c72b3

                                                                                  SHA512

                                                                                  86ffa374c2572cf61c670ec5469b80a9f71db097a87e45393aac98ac96a1c019325f360ccbaa6509acd366045c871b0e2ce76503942603228cf87b5c18105586

                                                                                • /tmp/conf.n

                                                                                  Filesize

                                                                                  69B

                                                                                  MD5

                                                                                  0d4750fec88f900553a9e4c96401dc0d

                                                                                  SHA1

                                                                                  e10dde0a5028e3fd300fb85b50ff4e0e228eae4a

                                                                                  SHA256

                                                                                  4cfb90ff9316f4c96aca3e9bf13ff354de99c6b31bc3451a810a0fffebcfb176

                                                                                  SHA512

                                                                                  63ef47b7279afe6bd17028e03f5c124de78dc817fdd4607ffb0a51be0c8c95a76318435b5f0b883d4d20ff54d7f52fbd1877f2952bbfaaeddcc7417f842f840c

                                                                                • /tmp/notify.file

                                                                                  Filesize

                                                                                  69B

                                                                                  MD5

                                                                                  830fecbd08ef05059315cbcad7735639

                                                                                  SHA1

                                                                                  a178557cb7efc7e62a28071fdb464e982a8c254b

                                                                                  SHA256

                                                                                  83a6029fd731a7c3581fdc37d650d679f934c9944decfffcd786f8cf7e02dfae

                                                                                  SHA512

                                                                                  39cd0d035a01c32e9debf33771f56d9afa442f5d5d5365f3b93b84ec11e348321aa4c08a40109cfc520a9c9e8e8d58df64dd233852323eea7ac2a26fe78c8019

                                                                                • /usr/bin/bsd-port/recei

                                                                                  Filesize

                                                                                  1.1MB

                                                                                  MD5

                                                                                  f57f99f56834d73211bac97f4ec2dc5c

                                                                                  SHA1

                                                                                  314fff2c301fb120ce100e812e3ef4b31580551d

                                                                                  SHA256

                                                                                  a7d548bcb9a58a58b5dfb9f059b302131fc0107a094f1fbb53c7d525b9327b60

                                                                                  SHA512

                                                                                  c2785a0b3231ccd5c217f6ec38aa8ca3ece2cc3a3364a3271582ba49cf9ac8a5dfd163765c6284ba72c9bd4e711cc059ba328e6a7ad0b1adeb7e85447b9350a8

                                                                                • /usr/bin/dpkgd/lsof

                                                                                  Filesize

                                                                                  163KB

                                                                                  MD5

                                                                                  ab57b66cc531ae0f996963223e632b60

                                                                                  SHA1

                                                                                  bf7e5becd33f21c2539f5a75ffa0ab61c49c8795

                                                                                  SHA256

                                                                                  2484863a7bfda7f97b90bfd5dfceed4ec9f27dd51f9c5158c8daabbf4309b1df

                                                                                  SHA512

                                                                                  908acef13f3c1d80b7169ec3b16bb67006013453348fff75550bc3c6c2137e798b21d7990edbd5be63d756d9c41b06160aebf38aa80547e4bafa3a62596057f6

                                                                                • /usr/bin/dpkgd/ps

                                                                                  Filesize

                                                                                  138KB

                                                                                  MD5

                                                                                  8146139c2ad7e550b1d1f49480997446

                                                                                  SHA1

                                                                                  074db8890c3227bd8a588417f5b9bde637bcf3af

                                                                                  SHA256

                                                                                  207df9d438f75185ab3af2ab1173d104831a6631c28ef40d38b2ab43de27b40f

                                                                                  SHA512

                                                                                  b6d71d537f593b9af833e6f798e412e95fc486a313414ed8cca9639f61be7ac9dca700e9f861c0d07c7f65b3783127a67f829f422472cad8938ba01d397ab9de