mrblack | 5a034a48b72c2ac211a7ed8ca6a60ea4bcd9e320ccef5069d82715662e213f27

Analysis

max time kernel
149s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20250619-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20250619-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
30/09/2025, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sshd.elf
Size 1.2MB
Sample250930-scelwsyscz
SHA256 5a034a48b72c2ac211a7ed8ca6a60ea4bcd9e320ccef5069d82715662e213f27
MD5 d48e32bbb8476e03490dc99a008d16a0
SHA1 77f02ad7c65f7eeb1cd9f07d2bf33344c3eb3af9
SHA512 e55d8f99432e0fa004b18035977cf3546f378cc70a6be0ced5a9106711a14e36c3a9f29f8291b09bc8b1b78001f541789b366b4713a1923d605af60875099c9e
SSDEEP 24576:e845rGHu6gVJKG75oFpA0VWeX4c2y1q2rJp0:745vRVJKGtSA0VWeoTu9p0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

antivm botnet defense_evasion discovery mrblack persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack

Mrblack family
mrblack

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1553	chmod
1563	chmod
1573	chmod

Executes dropped EXE 2 IoCs

ioc	pid
/usr/bin/bsd-port/getty	1521
/usr/bin/.sshd	1545

Modifies init.d 2 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc
File opened for modification	/etc/init.d/DbSecuritySpt
File opened for modification	/etc/init.d/selinux

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc
File opened for reading	/proc/net/route

Write file to user bin folder 8 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/udevd.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc
File opened for reading	/proc/cpuinfo

Reads system network configuration 1 TTPs 3 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc
File opened for reading	/proc/net/dev
File opened for reading	/proc/net/route
File opened for reading	/proc/net/arp

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/meminfo	Process not Found
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	Process not Found
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/moni.lod
File opened for modification	/tmp/bill.lock
File opened for modification	/tmp/gates.lod
File opened for modification	/tmp/notify.file
File opened for modification	/tmp/conf.n

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
1⤵
PID:1504

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
1⤵
PID:1506

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
1⤵
PID:1508

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
1⤵
PID:1510

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
1⤵
PID:1512

/bin/mkdir
mkdir -p /usr/bin/bsd-port
1⤵
- Reads runtime system information
PID:1514

/bin/mkdir
mkdir -p /usr/bin/bsd-port
1⤵
- Reads runtime system information
PID:1516

/bin/cp
cp -f /tmp/sshd.elf /usr/bin/bsd-port/getty
1⤵
- Write file to user bin folder
- Reads runtime system information
PID:1518

/bin/mkdir
mkdir -p /usr/bin
1⤵
- Reads runtime system information
PID:1524

/bin/mkdir
mkdir -p /usr/bin
1⤵
- Reads runtime system information
PID:1526

/bin/cp
cp -f /tmp/sshd.elf /usr/bin/.sshd
1⤵
- Write file to user bin folder
- Reads runtime system information
PID:1528

/bin/ln
ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
1⤵
PID:1530

/bin/ln
ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
1⤵
PID:1532

/bin/ln
ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
1⤵
PID:1534

/bin/ln
ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
1⤵
PID:1536

/bin/ln
ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
1⤵
PID:1538

/bin/mkdir
mkdir -p /usr/bin/dpkgd
1⤵
- Reads runtime system information
PID:1540

/bin/cp
cp -f /bin/ps /usr/bin/dpkgd/ps
1⤵
- Write file to user bin folder
- Reads runtime system information
PID:1542

/bin/mkdir
mkdir -p /bin
1⤵
- Reads runtime system information
PID:1547

/bin/mkdir
mkdir -p /bin
1⤵
- Reads runtime system information
PID:1549

/bin/cp
cp -f /usr/bin/bsd-port/getty /bin/ps
1⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1551

/bin/chmod
chmod 0755 /bin/ps
1⤵
- File and Directory Permissions Modification
PID:1553

/bin/cp
cp -f /bin/ss /usr/bin/dpkgd/ss
1⤵
- Write file to user bin folder
- Reads runtime system information
PID:1555

/bin/mkdir
mkdir -p /bin
1⤵
- Reads runtime system information
PID:1557

/bin/mkdir
mkdir -p /bin
1⤵
- Reads runtime system information
PID:1559

/bin/cp
cp -f /usr/bin/bsd-port/getty /bin/ss
1⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1561

/bin/chmod
chmod 0755 /bin/ss
1⤵
- File and Directory Permissions Modification
PID:1563

/bin/cp
cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
1⤵
- Write file to user bin folder
- Reads runtime system information
PID:1565

/bin/mkdir
mkdir -p /usr/bin
1⤵
- Reads runtime system information
PID:1567

/bin/mkdir
mkdir -p /usr/bin
1⤵
- Reads runtime system information
PID:1569

/bin/cp
cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
1⤵
- Write file to user bin folder
- Reads runtime system information
PID:1571

/bin/chmod
chmod 0755 /usr/bin/lsof
1⤵
- File and Directory Permissions Modification
PID:1573

/sbin/insmod
insmod /usr/bin/bsd-port/xpacket.ko
1⤵
- Reads runtime system information
PID:1577

/sbin/insmod
insmod /tmp/xpacket.ko
1⤵
- Reads runtime system information
PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DbSecuritySpt

Path /etc/init.d/DbSecuritySpt
Size 26B
SHA256 ec549ad05ab30f67bbde33458bb56e60949d0d04e9179cb288fcc92a14475dd9
MD5 7e3e4ac1fef72a0a256b4c8f330e58c9
SHA1 8934ef0800af31ff3e830b2c28bd25aff086cfa9
SHA512 cf146d2a019fb135dcdfdbc3497f46ec1e49e04f0d91ec681a3cd9df8a42db04590282783ff37f13b1af1748d2589ff543e76855645327782ea0c3080b6cb01b
MD5 SHA1 SHA512

Submit Download

selinux

Path /etc/init.d/selinux
Size 36B
SHA256 8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
MD5 993cc15058142d96c3daf7852c3d5ee8
SHA1 0950b8b391b04dd3895ea33cd3141543ebd2525d
SHA512 0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928
MD5 SHA1 SHA512

Submit Download

gates.lod

Path /tmp/gates.lod
Size 4B
SHA256 a3d0c75739a3c6a80dcb6f9d71f9da29b49b62995801bc52957e06acb87db33d
MD5 6490791e7abf6b29a381288cc23a8223
SHA1 37585335691c5a6647266cf0d14de500031ffb07
SHA512 0b9949d3e3876df3bbc54d3aa797c8564dfc6f68256ea6ec85655ed0a430ced8a099641c0d401a87a6ba1b1580dfd73dfd84a50fbf8b2cfd06103cf47538800e
MD5 SHA1 SHA512

Submit Download

moni.lod

Path /tmp/moni.lod
Size 4B
SHA256 ef4cf73add6b6f476ece3477b6235878bc8a0de65fe7f561200ebac7f18db18a
MD5 0d4f4805c36dc6853edfa4c7e1638b48
SHA1 0dd8e2fe2969e0722430655502c0c0607a5b30be
SHA512 d0db9c1410d20e92c528bcc5d9973cec935bc4b87940bc8d15e100849034156c6670c60e3faa71c633ad03bf1c490550330ecbb336a2139d8cbcf99f00588b54
MD5 SHA1 SHA512

Submit Download

notify.file

Path /tmp/notify.file
Size 13B
SHA256 471af8a68509ab6c2f0f611dcb3ebbce23a142589b6f70251fe64cf12f3e1ac9
MD5 1ed6d8114726fbcc36da74441f816b94
SHA1 8d7a38995d88fde75b0c923a3041b83e4cd49a42
SHA512 7fe86987d658be691885f7489d823c5436bfe2bcd1e07400636879cbcb92d63a63c197992e336e7967bdc1ff3b34c295cf808cd6a2defa5fccff529156e8c902
MD5 SHA1 SHA512

Submit Download

getty

Path /usr/bin/bsd-port/getty
Size 1.2MB
SHA256 5a034a48b72c2ac211a7ed8ca6a60ea4bcd9e320ccef5069d82715662e213f27
MD5 d48e32bbb8476e03490dc99a008d16a0
SHA1 77f02ad7c65f7eeb1cd9f07d2bf33344c3eb3af9
SHA512 e55d8f99432e0fa004b18035977cf3546f378cc70a6be0ced5a9106711a14e36c3a9f29f8291b09bc8b1b78001f541789b366b4713a1923d605af60875099c9e
SSDEEP 24576:e845rGHu6gVJKG75oFpA0VWeX4c2y1q2rJp0:745vRVJKGtSA0VWeoTu9p0
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsof

Path /usr/bin/dpkgd/lsof
Size 159KB
SHA256 1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
MD5 e093dc78225e2a0a25e3b137c1c1e442
SHA1 c29497cfaae729eb576875e4fdfa400640ab16be
SHA512 fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
SSDEEP 3072:hjPgyal2U77E/kgY4cRur6kgPfavXynehy5frrI3maA4EWy4+Qsp8AY8Vl/2eOmr:hjPfUTu+kSavCn6y5frrI3maA4EWy4+Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /usr/bin/dpkgd/ps
Size 130KB
SHA256 b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
MD5 558edc26f8a38fa9788220b9af8a73e7
SHA1 3024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA512 edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f
SSDEEP 3072:d/gUagOnBU+N7P2tTJ4hKcsIcKRKrXbys8Z:JgRBd7PcTJrrXb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /usr/bin/dpkgd/ss
Size 136KB
SHA256 418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38
MD5 1dc929b5f2cd12fe6a2fe71140d2a9e3
SHA1 f9995a92bb201b1b7738a39a38570ef0c40b52d2
SHA512 fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373
SSDEEP 3072:mPdG0jQRvX4bYFa16g109+NQvUWsGKIJfokf2X/:mPd21EI9tTYIJfokf2X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads