mrblack | 44c7eefa677b9672df14d8cd1ce5dd9967fa92d37bed468cb84e862293dd8566

Analysis

max time kernel
143s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20250619-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20250619-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
30/09/2025, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kal64.elf
Size 2.7MB
Sample250930-saqw5sysbt
SHA256 44c7eefa677b9672df14d8cd1ce5dd9967fa92d37bed468cb84e862293dd8566
MD5 a72cbe8fa86b5f47b20f8d8aec3f7e75
SHA1 1eb8203183ac0c4561d48de7fbd4a4c76e245a0e
SHA512 7ab079e7df610d21b5e8fb4d19f5a16a6d2b9f95a683423b3c7b68a8f84a8a3b0c158095afa922ca45da6bbc091c233f2dc9d63315b0aa7db78aa4bfa59d3af0
SSDEEP 49152:V5YUwUtRIP45vRVJKGtSA0VWeoTu9prY26S:7tMERVJK0SzVW5u9peS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

antivm botnet defense_evasion discovery mrblack persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_mrblack

Mrblack family
mrblack

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1556	chmod
1566	chmod
1576	chmod

Executes dropped EXE 3 IoCs

ioc	pid	Process
/lib/systemd/system/systemd	1500	kal64.elf
/usr/bin/bsd-port/getty	1524	kal64.elf
/usr/bin/.sshd	1548	kal64.elf

Modifies init.d 2 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/DbSecuritySpt	kal64.elf
File opened for modification	/etc/init.d/selinux	kal64.elf

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	kal64.elf

Write file to user bin folder 8 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	kal64.elf
File opened for modification	/usr/bin/bsd-port/udevd.lock	kal64.elf
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	kal64.elf

Reads system network configuration 1 TTPs 3 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/dev	kal64.elf
File opened for reading	/proc/net/route	kal64.elf
File opened for reading	/proc/net/arp	kal64.elf

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	kal64.elf

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/meminfo	kal64.elf
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	kal64.elf
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/notify.file	kal64.elf
File opened for modification	/tmp/moni.lod	kal64.elf
File opened for modification	/tmp/bill.lock	kal64.elf
File opened for modification	/tmp/gates.lod	kal64.elf

/tmp/kal64.elf
/tmp/kal64.elf
1⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1496
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:1507
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:1509
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:1511
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:1513
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:1515
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1517
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1519
- /bin/cp
  cp -f /lib/systemd/system/systemd /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1521
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1527
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1529
- /bin/cp
  cp -f /lib/systemd/system/systemd /usr/bin/.sshd
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1531
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
  2⤵
  PID:1533
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
  2⤵
  PID:1535
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
  2⤵
  PID:1537
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
  2⤵
  PID:1539
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
  2⤵
  PID:1541
- /bin/mkdir
  mkdir -p /usr/bin/dpkgd
  2⤵
  - Reads runtime system information
  PID:1543
- /bin/cp
  cp -f /bin/ps /usr/bin/dpkgd/ps
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1545
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1550
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1552
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ps
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1554
- /bin/chmod
  chmod 0755 /bin/ps
  2⤵
  - File and Directory Permissions Modification
  PID:1556
- /bin/cp
  cp -f /bin/ss /usr/bin/dpkgd/ss
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1558
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1560
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1562
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ss
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1564
- /bin/chmod
  chmod 0755 /bin/ss
  2⤵
  - File and Directory Permissions Modification
  PID:1566
- /bin/cp
  cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1568
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1570
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1572
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1574
- /bin/chmod
  chmod 0755 /usr/bin/lsof
  2⤵
  - File and Directory Permissions Modification
  PID:1576
- /sbin/insmod
  insmod /usr/bin/bsd-port/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1580
- /sbin/insmod
  insmod /lib/systemd/system/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1591

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DbSecuritySpt

Path /etc/init.d/DbSecuritySpt
Size 40B
SHA256 f3dfbc991c5f5086aff50479ea9c610dfb2be9dd078bfdd2cd283f792616649c
MD5 567fed2665c36cc23fed39e5a0caa980
SHA1 27734d85334322d4530b57d8667bef9d4efc5258
SHA512 0f52711040820728bb0663e88b36aab8be34c363844cd4062ff3e1e9b84d127777433528e5de8c81a1b7e453c3abef8b96d9ff64e54e5e321def121aa56d597e
MD5 SHA1 SHA512

Submit Download

selinux

Path /etc/init.d/selinux
Size 36B
SHA256 8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
MD5 993cc15058142d96c3daf7852c3d5ee8
SHA1 0950b8b391b04dd3895ea33cd3141543ebd2525d
SHA512 0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928
MD5 SHA1 SHA512

Submit Download

conf.n

Path /lib/systemd/system/conf.n
Size 73B
SHA256 fbd8ec381b31b530497b049a23ef6a26ee7c0ebc35868f96e4dd3ab8c0f86c13
MD5 dbe460de5fac414fb1b673011804d35f
SHA1 0e62853fe1accdeb3659e1588b995a1bb02c7a5d
SHA512 06ae8d98efba360f0cd57428ab6fcdb3d618520d7f969101053a35f0bf33a8c9a179741b2dcc53605c2f4c9a37c99e92ff69f805b079600cca9096e6e57e022e
MD5 SHA1 SHA512

Submit Download

systemd

Path /lib/systemd/system/systemd
Size 1.2MB
SHA256 5a034a48b72c2ac211a7ed8ca6a60ea4bcd9e320ccef5069d82715662e213f27
MD5 d48e32bbb8476e03490dc99a008d16a0
SHA1 77f02ad7c65f7eeb1cd9f07d2bf33344c3eb3af9
SHA512 e55d8f99432e0fa004b18035977cf3546f378cc70a6be0ced5a9106711a14e36c3a9f29f8291b09bc8b1b78001f541789b366b4713a1923d605af60875099c9e
SSDEEP 24576:e845rGHu6gVJKG75oFpA0VWeX4c2y1q2rJp0:745vRVJKGtSA0VWeoTu9p0
MD5 SHA1 SHA512 SSDEEP

Submit Download

gates.lod

Path /tmp/gates.lod
Size 4B
SHA256 3873ecf4855ce373db4b7afc32fe5884d984d37a32c2c605065671d3eed825d4
MD5 5cbdfd0dfa22a3fca7266376887f549b
SHA1 0e55c1a2d589c70e5cfe4c2ecdb1ccd2607aa44f
SHA512 35fc7e0ddb30c7736f785b0537f949ea370644ba6414a855548cb5ff1e0f7a9590b34dcacadcccc0883e4b4055b6fa9e12a25203b06423873ceccde1160f34e4
MD5 SHA1 SHA512

Submit Download

moni.lod

Path /tmp/moni.lod
Size 4B
SHA256 1d16bb3354a11b509e641db094ca078be290298b0ec32c6b46b88fe919a1a8ed
MD5 7e1d842d0f7ee600116ffc6b2d87d83f
SHA1 58cb004c78ad7dd27552600c7c1d525e5797cd1d
SHA512 113c6380957062e07ff7390ef365b7352fa3e96dabb6503422821a7de921d40296db514ff99bf85f780aee8486787810184d16106a8a7ccdc92423e23bf31575
MD5 SHA1 SHA512

Submit Download

notify.file

Path /tmp/notify.file
Size 27B
SHA256 500c12c1093899c14d1d1aaea57558d9bca3c128d01385ad0477541d09c41b10
MD5 1cabfd0fae92908a602541bdce8043ca
SHA1 5737a1b77460b271f2b9f5f08b34b7bcbbb40ef8
SHA512 845c2c59397604e18e7ede6b5c57e8ea257ffa4cb029a342fe40c51cbcbb1278769a80dd86e21644788c475f2711f0144464036c72d62f8e2125f568af901a43
MD5 SHA1 SHA512

Submit Download

lsof

Path /usr/bin/dpkgd/lsof
Size 159KB
SHA256 1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
MD5 e093dc78225e2a0a25e3b137c1c1e442
SHA1 c29497cfaae729eb576875e4fdfa400640ab16be
SHA512 fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
SSDEEP 3072:hjPgyal2U77E/kgY4cRur6kgPfavXynehy5frrI3maA4EWy4+Qsp8AY8Vl/2eOmr:hjPfUTu+kSavCn6y5frrI3maA4EWy4+Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /usr/bin/dpkgd/ps
Size 130KB
SHA256 b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
MD5 558edc26f8a38fa9788220b9af8a73e7
SHA1 3024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA512 edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f
SSDEEP 3072:d/gUagOnBU+N7P2tTJ4hKcsIcKRKrXbys8Z:JgRBd7PcTJrrXb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /usr/bin/dpkgd/ss
Size 136KB
SHA256 418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38
MD5 1dc929b5f2cd12fe6a2fe71140d2a9e3
SHA1 f9995a92bb201b1b7738a39a38570ef0c40b52d2
SHA512 fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373
SSDEEP 3072:mPdG0jQRvX4bYFa16g109+NQvUWsGKIJfokf2X/:mPd21EI9tTYIJfokf2X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads