mrblack | a81f677c5e70b1031e5faddd50ba3492e6d536ce672fa17c173f916b88e45d46

General

Target

f17b36cfddb5242cb530ee6f62fd72ad_JaffaCakes118
Size

1.1MB
MD5

f17b36cfddb5242cb530ee6f62fd72ad
SHA1

1dad9668f72f681c865d058027d0eb474f920613
SHA256

a81f677c5e70b1031e5faddd50ba3492e6d536ce672fa17c173f916b88e45d46
SHA512

c0edc007a5030e95cc63467e5de00ba3152f3150dc9247850553fbf0542e2c6bf59543d6cca1e38dd8fdc490a2984d515a6d984e6d8833e64c90e07383d7fa16
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfamI+gIGYuuCol7r:4vREKfPqVE5jKsfamRHGVo7r

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

Processes:

resource	yara_rule
/usr/bin/bsd-port/agent	family_mrblack

Executes dropped EXE 2 IoCs

Processes:

agentacpid

ioc pid process

/usr/bin/bsd-port/agent 1567 agent
/usr/bin/acpid 1589 acpid
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

description ioc

File opened for reading /proc/cpuinfo
Modifies init.d 1 TTPs 2 IoCs
Adds/modifies system service, likely for persistence.
persistence

Boot or Logon Autostart Execution
T1547

Processes:

description ioc

File opened for modification /etc/init.d/DbSecurityMdt
File opened for modification /etc/init.d/selinux

ioc	pid	process
/usr/bin/bsd-port/agent	1567	agent
/usr/bin/acpid	1589	acpid

description	ioc
File opened for reading	/proc/cpuinfo

description	ioc
File opened for modification	/etc/init.d/DbSecurityMdt
File opened for modification	/etc/init.d/selinux

Write file to user bin folder 1 TTPs 7 IoCs

Hijack Execution Flow

T1574

Processes:

cpcpcpcpcp

description	ioc
File opened for modification	/usr/bin/bsd-port/udevd.conf
File opened for modification	/usr/bin/bsd-port/agent	cp
File opened for modification	/usr/bin/acpid	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/agent.conf

Writes file to system bin folder 1 TTPs 1 IoCs

Hijack Execution Flow
T1574

Processes:

cp

description ioc process

File opened for modification /bin/ps cp
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

description ioc

File opened for reading /proc/net/dev

description	ioc	process
File opened for modification	/bin/ps	cp

description	ioc
File opened for reading	/proc/net/dev

Reads runtime system information 15 IoCs

Reads data from /proc virtual filesystem.

Processes:

cpinsmodcpcpcpinsmodmkdircpmkdirmkdirmkdircpmkdir

description	ioc	process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/stat
File opened for reading	/proc/meminfo
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

Processes:

description	ioc
File opened for modification	/tmp/gates.note
File opened for modification	/tmp/notify.file
File opened for modification	/tmp/moni.note
File opened for modification	/tmp/bill.note

/tmp/f17b36cfddb5242cb530ee6f62fd72ad_JaffaCakes118
/tmp/f17b36cfddb5242cb530ee6f62fd72ad_JaffaCakes118
1⤵
PID:1536

/bin/sh
sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc1.d/S97DbSecurityMdt"
1⤵
PID:1551

/bin/ln
ln -s /etc/init.d/DbSecurityMdt /etc/rc1.d/S97DbSecurityMdt
2⤵
PID:1552

/bin/sh
sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc2.d/S97DbSecurityMdt"
1⤵
PID:1553

/bin/ln
ln -s /etc/init.d/DbSecurityMdt /etc/rc2.d/S97DbSecurityMdt
2⤵
PID:1554

/bin/sh
sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc3.d/S97DbSecurityMdt"
1⤵
PID:1555

/bin/ln
ln -s /etc/init.d/DbSecurityMdt /etc/rc3.d/S97DbSecurityMdt
2⤵
PID:1556

/bin/sh
sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc4.d/S97DbSecurityMdt"
1⤵
PID:1557

/bin/ln
ln -s /etc/init.d/DbSecurityMdt /etc/rc4.d/S97DbSecurityMdt
2⤵
PID:1558

/bin/sh
sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc5.d/S97DbSecurityMdt"
1⤵
PID:1559

/bin/ln
ln -s /etc/init.d/DbSecurityMdt /etc/rc5.d/S97DbSecurityMdt
2⤵
PID:1560

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
1⤵
PID:1561

/bin/mkdir
mkdir -p /usr/bin/bsd-port
2⤵
- Reads runtime system information
PID:1562

/bin/sh
sh -c "cp -f /tmp/f17b36cfddb5242cb530ee6f62fd72ad_JaffaCakes118 /usr/bin/bsd-port/agent"
1⤵
PID:1563

/bin/cp
cp -f /tmp/f17b36cfddb5242cb530ee6f62fd72ad_JaffaCakes118 /usr/bin/bsd-port/agent
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1564

/bin/sh
sh -c /usr/bin/bsd-port/agent
1⤵
PID:1566

/usr/bin/bsd-port/agent
/usr/bin/bsd-port/agent
2⤵
- Executes dropped EXE
PID:1567

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1569

/bin/mkdir
mkdir -p /usr/bin
2⤵
- Reads runtime system information
PID:1570

/bin/sh
sh -c "cp -f /tmp/f17b36cfddb5242cb530ee6f62fd72ad_JaffaCakes118 /usr/bin/acpid"
1⤵
PID:1571

/bin/cp
cp -f /tmp/f17b36cfddb5242cb530ee6f62fd72ad_JaffaCakes118 /usr/bin/acpid
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1572

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
1⤵
PID:1573

/bin/ln
ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
2⤵
PID:1574

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
1⤵
PID:1575

/bin/ln
ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
2⤵
PID:1576

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
1⤵
PID:1577

/bin/ln
ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
2⤵
PID:1578

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
1⤵
PID:1579

/bin/ln
ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
2⤵
PID:1580

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
1⤵
PID:1581

/bin/ln
ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
2⤵
PID:1582

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
1⤵
PID:1583

/bin/mkdir
mkdir -p /usr/bin/dpkgd
2⤵
- Reads runtime system information
PID:1584

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
1⤵
PID:1585

/bin/cp
cp -f /bin/ps /usr/bin/dpkgd/ps
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1586

/bin/sh
sh -c /usr/bin/acpid
1⤵
PID:1588

/usr/bin/acpid
/usr/bin/acpid
2⤵
- Executes dropped EXE
PID:1589

/bin/sh
sh -c "insmod /usr/lib/xpacket.ko"
1⤵
PID:1591

/sbin/insmod
insmod /usr/lib/xpacket.ko
2⤵
- Reads runtime system information
PID:1593

/bin/sh
sh -c "mkdir -p /bin"
1⤵
PID:1592

/bin/mkdir
mkdir -p /bin
2⤵
- Reads runtime system information
PID:1594

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/agent /bin/ps"
1⤵
PID:1595

/bin/cp
cp -f /usr/bin/bsd-port/agent /bin/ps
2⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1597

/bin/sh
sh -c "chmod 0755 /bin/ps"
1⤵
PID:1599

/bin/chmod
chmod 0755 /bin/ps
2⤵
PID:1600

/bin/sh
sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
1⤵
PID:1601

/bin/cp
cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1602

/bin/sh
sh -c "mkdir -p /usr/bin"
1⤵
PID:1603

/bin/mkdir
mkdir -p /usr/bin
2⤵
- Reads runtime system information
PID:1604

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/agent /usr/bin/lsof"
1⤵
PID:1606

/bin/cp
cp -f /usr/bin/bsd-port/agent /usr/bin/lsof
2⤵
- Write file to user bin folder
- Reads runtime system information
PID:1607

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
1⤵
PID:1608

/bin/chmod
chmod 0755 /usr/bin/lsof
2⤵
PID:1609

/bin/sh
sh -c "insmod /usr/lib/xpacket.ko"
1⤵
PID:1610

/sbin/insmod
insmod /usr/lib/xpacket.ko
2⤵
- Reads runtime system information
PID:1611

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Hijack Execution Flow

2

T1574

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Hijack Execution Flow

2

T1574

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Hijack Execution Flow

2

T1574

Credential Access

Discovery

Virtualization/Sandbox Evasion

1

T1497

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecurityMdt
Filesize
64B

MD5
4b28dd51490de8e95c780ae9561e1255

SHA1
71912a13d958ba296fea6a71df500bfc64ac95be

SHA256
4c5053f7a5bf93fc510ea44d82208ccf2429fe4e5789e52fcab3d6a8c5eb2bab

SHA512
7dfe9547d9b335259a80469bb8a0b9fa399f89f868c140448099f890fa67c4b92899e590558d25f8435ff556975e93e0e148068323dc2ea6c480ed7a67b08462

Download Submit
/etc/init.d/selinux
Filesize
36B

MD5
c6a80f08539a4c3176762f514976dd24

SHA1
bbc5826b01d20f5c4d315ff5dbc3f216760c64ef

SHA256
ea47e885ae227059ce55d020335f7869c565ec6d85f484497e83cd4998149d5d

SHA512
9a1e3b0142876305fe389e07880bd586e97bf709273a66299d9128ff2861459104054d4e5d836aecdf73f2c11886fa3a2a8498741adb3211b96116658b856175

Download Submit
/tmp/gates.note
Filesize
4B

MD5
d1a69640d53a32a9fb13e93d1c8f3104

SHA1
ad896e3ecf46771003093f24b88cd72af2225023

SHA256
6a27eece1c1658b237aede5c6c2b8af51d235ca08b2f7963b67d99caa7a12395

SHA512
100604d883bb248a24436fea1542cf81636e693256e0f0e8943c3cbdf7aa89bf759ddad050d1c3c487c07b00258dc0e6eefbc04d7109d7a788e2f8b98a9e3894

Download Submit
/tmp/moni.note
Filesize
4B

MD5
bcb41ccdc4363c6848a1d760f26c28a0

SHA1
e66d35a623d670f416f6080f849b834be5e04d17

SHA256
6c77b607e17df16d31c46c746a36328056fc8d153b71370ed1a56d4c0700238e

SHA512
bb8e75c07ce94b7022865b826126bbba68cea5110cf353f015b80727782246fbff3e004a655b00d495e34f4d426f42abba8558e4bf1e557ca381f0c8e280da6c

Download Submit
/tmp/notify.file
Filesize
51B

MD5
79088c38abb3a242f72d3bef40de7e71

SHA1
dae965ccd8e9598f28d41f637aa0d26ed27fe254

SHA256
cb231b01ee637b58abe40914373e8eb921e5de1f3bca2a4f64e1e5ae001c273c

SHA512
5d4e06c1a9a3b40c8397f78beb7173dddefc8737fdc649a40e6e59c3df387c4e02d3c3cfa0d1c794d8b1e16d0e1a4f47e854bf602044fce7db48aff00ce4cf04

Download Submit
/usr/bin/bsd-port/agent
Filesize
1.1MB

MD5
f17b36cfddb5242cb530ee6f62fd72ad

SHA1
1dad9668f72f681c865d058027d0eb474f920613

SHA256
a81f677c5e70b1031e5faddd50ba3492e6d536ce672fa17c173f916b88e45d46

SHA512
c0edc007a5030e95cc63467e5de00ba3152f3150dc9247850553fbf0542e2c6bf59543d6cca1e38dd8fdc490a2984d515a6d984e6d8833e64c90e07383d7fa16

Download Submit
/usr/bin/dpkgd/lsof
Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps
Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads