mrblack | 44c7eefa677b9672df14d8cd1ce5dd9967fa92d37bed468cb84e862293dd8566

Analysis

max time kernel
133s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20250619-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20250619-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
01/10/2025, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kal64
Size 2.7MB
Sample251001-3aybbsttdy
SHA256 44c7eefa677b9672df14d8cd1ce5dd9967fa92d37bed468cb84e862293dd8566
MD5 a72cbe8fa86b5f47b20f8d8aec3f7e75
SHA1 1eb8203183ac0c4561d48de7fbd4a4c76e245a0e
SHA512 7ab079e7df610d21b5e8fb4d19f5a16a6d2b9f95a683423b3c7b68a8f84a8a3b0c158095afa922ca45da6bbc091c233f2dc9d63315b0aa7db78aa4bfa59d3af0
SSDEEP 49152:V5YUwUtRIP45vRVJKGtSA0VWeoTu9prY26S:7tMERVJK0SzVW5u9peS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

antivm botnet defense_evasion discovery mrblack persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	family_mrblack

Mrblack family
mrblack

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1594	chmod
1604	chmod
1584	chmod

Executes dropped EXE 3 IoCs

ioc	pid	Process
/lib/systemd/system/systemd	1529	kal64
/usr/bin/bsd-port/getty	1552	kal64
/usr/bin/.sshd	1576	kal64

Modifies init.d 2 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/DbSecuritySpt	kal64
File opened for modification	/etc/init.d/selinux	kal64

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	kal64

Write file to user bin folder 8 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	kal64
File opened for modification	/usr/bin/bsd-port/udevd.lock	kal64

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	kal64

Reads system network configuration 1 TTPs 3 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/dev	kal64
File opened for reading	/proc/net/route	kal64
File opened for reading	/proc/net/arp	kal64

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	kal64

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/stat	kal64
File opened for reading	/proc/meminfo	kal64
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/moni.lod	kal64
File opened for modification	/tmp/bill.lock	kal64
File opened for modification	/tmp/gates.lod	kal64
File opened for modification	/tmp/notify.file	kal64

/tmp/kal64
/tmp/kal64
1⤵
- Executes dropped EXE
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1525
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
  2⤵
  PID:1535
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
  2⤵
  PID:1537
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
  2⤵
  PID:1539
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
  2⤵
  PID:1541
- /bin/ln
  ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
  2⤵
  PID:1543
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1545
- /bin/mkdir
  mkdir -p /usr/bin/bsd-port
  2⤵
  - Reads runtime system information
  PID:1547
- /bin/cp
  cp -f /lib/systemd/system/systemd /usr/bin/bsd-port/getty
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1549
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1555
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1557
- /bin/cp
  cp -f /lib/systemd/system/systemd /usr/bin/.sshd
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1559
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
  2⤵
  PID:1561
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
  2⤵
  PID:1563
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
  2⤵
  PID:1565
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
  2⤵
  PID:1567
- /bin/ln
  ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
  2⤵
  PID:1569
- /bin/mkdir
  mkdir -p /usr/bin/dpkgd
  2⤵
  - Reads runtime system information
  PID:1571
- /bin/cp
  cp -f /bin/ps /usr/bin/dpkgd/ps
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1573
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1578
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1580
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ps
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1582
- /bin/chmod
  chmod 0755 /bin/ps
  2⤵
  - File and Directory Permissions Modification
  PID:1584
- /bin/cp
  cp -f /bin/ss /usr/bin/dpkgd/ss
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1586
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1588
- /bin/mkdir
  mkdir -p /bin
  2⤵
  - Reads runtime system information
  PID:1590
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /bin/ss
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:1592
- /bin/chmod
  chmod 0755 /bin/ss
  2⤵
  - File and Directory Permissions Modification
  PID:1594
- /bin/cp
  cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1596
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1598
- /bin/mkdir
  mkdir -p /usr/bin
  2⤵
  - Reads runtime system information
  PID:1600
- /bin/cp
  cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:1602
- /bin/chmod
  chmod 0755 /usr/bin/lsof
  2⤵
  - File and Directory Permissions Modification
  PID:1604
- /sbin/insmod
  insmod /usr/bin/bsd-port/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1608
- /sbin/insmod
  insmod /lib/systemd/system/xpacket.ko
  2⤵
  - Reads runtime system information
  PID:1619

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DbSecuritySpt

Path /etc/init.d/DbSecuritySpt
Size 40B
SHA256 f3dfbc991c5f5086aff50479ea9c610dfb2be9dd078bfdd2cd283f792616649c
MD5 567fed2665c36cc23fed39e5a0caa980
SHA1 27734d85334322d4530b57d8667bef9d4efc5258
SHA512 0f52711040820728bb0663e88b36aab8be34c363844cd4062ff3e1e9b84d127777433528e5de8c81a1b7e453c3abef8b96d9ff64e54e5e321def121aa56d597e
MD5 SHA1 SHA512

Submit Download

selinux

Path /etc/init.d/selinux
Size 36B
SHA256 8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
MD5 993cc15058142d96c3daf7852c3d5ee8
SHA1 0950b8b391b04dd3895ea33cd3141543ebd2525d
SHA512 0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928
MD5 SHA1 SHA512

Submit Download

conf.n

Path /lib/systemd/system/conf.n
Size 73B
SHA256 fbd8ec381b31b530497b049a23ef6a26ee7c0ebc35868f96e4dd3ab8c0f86c13
MD5 dbe460de5fac414fb1b673011804d35f
SHA1 0e62853fe1accdeb3659e1588b995a1bb02c7a5d
SHA512 06ae8d98efba360f0cd57428ab6fcdb3d618520d7f969101053a35f0bf33a8c9a179741b2dcc53605c2f4c9a37c99e92ff69f805b079600cca9096e6e57e022e
MD5 SHA1 SHA512

Submit Download

systemd

Path /lib/systemd/system/systemd
Size 1.2MB
SHA256 5a034a48b72c2ac211a7ed8ca6a60ea4bcd9e320ccef5069d82715662e213f27
MD5 d48e32bbb8476e03490dc99a008d16a0
SHA1 77f02ad7c65f7eeb1cd9f07d2bf33344c3eb3af9
SHA512 e55d8f99432e0fa004b18035977cf3546f378cc70a6be0ced5a9106711a14e36c3a9f29f8291b09bc8b1b78001f541789b366b4713a1923d605af60875099c9e
SSDEEP 24576:e845rGHu6gVJKG75oFpA0VWeX4c2y1q2rJp0:745vRVJKGtSA0VWeoTu9p0
MD5 SHA1 SHA512 SSDEEP

Submit Download

gates.lod

Path /tmp/gates.lod
Size 4B
SHA256 8ff9538e65e6781d654b811f88161d12455935ffb8f470815063b6ab6cb7fdff
MD5 cb8acb1dc9821bf74e6ca9068032d623
SHA1 0ad54e429b2b6238550f24701541130b978e4640
SHA512 355051ba1d636582e623824587c9d5c6e6cc4c98dc830c26b212d61d0d009b91ad062aa99c7c2a3982a3b34091c49e412d7bfaf6d57c80794e7b3c31801dd964
MD5 SHA1 SHA512

Submit Download

moni.lod

Path /tmp/moni.lod
Size 4B
SHA256 5909daa6fb5cf239d52027367f111ecd9c280866d73f8bd47cda43ef5495af6a
MD5 f18a6d1cde4b205199de8729a6637b42
SHA1 2fdd02f8f1222ac5b66ec221c8ff66d62695b11c
SHA512 3407704df3075afe3710ea8c7b64a54f572e311c24de4299fafb95203ac100326b1a9aec57289285ad641b51de049eb2b3ee66180b74c7bfda1b82b8664b9fc2
MD5 SHA1 SHA512

Submit Download

notify.file

Path /tmp/notify.file
Size 27B
SHA256 500c12c1093899c14d1d1aaea57558d9bca3c128d01385ad0477541d09c41b10
MD5 1cabfd0fae92908a602541bdce8043ca
SHA1 5737a1b77460b271f2b9f5f08b34b7bcbbb40ef8
SHA512 845c2c59397604e18e7ede6b5c57e8ea257ffa4cb029a342fe40c51cbcbb1278769a80dd86e21644788c475f2711f0144464036c72d62f8e2125f568af901a43
MD5 SHA1 SHA512

Submit Download

lsof

Path /usr/bin/dpkgd/lsof
Size 159KB
SHA256 1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
MD5 e093dc78225e2a0a25e3b137c1c1e442
SHA1 c29497cfaae729eb576875e4fdfa400640ab16be
SHA512 fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
SSDEEP 3072:hjPgyal2U77E/kgY4cRur6kgPfavXynehy5frrI3maA4EWy4+Qsp8AY8Vl/2eOmr:hjPfUTu+kSavCn6y5frrI3maA4EWy4+Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /usr/bin/dpkgd/ps
Size 130KB
SHA256 b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
MD5 558edc26f8a38fa9788220b9af8a73e7
SHA1 3024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA512 edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f
SSDEEP 3072:d/gUagOnBU+N7P2tTJ4hKcsIcKRKrXbys8Z:JgRBd7PcTJrrXb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /usr/bin/dpkgd/ss
Size 136KB
SHA256 418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38
MD5 1dc929b5f2cd12fe6a2fe71140d2a9e3
SHA1 f9995a92bb201b1b7738a39a38570ef0c40b52d2
SHA512 fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373
SSDEEP 3072:mPdG0jQRvX4bYFa16g109+NQvUWsGKIJfokf2X/:mPd21EI9tTYIJfokf2X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads