mrblack | 3af00ccefc81f874be86a1c3a6184b52a75d0cf4f91ab5343d3f9176cfcbd860

Analysis

max time kernel
149s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240226-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
07-05-2024 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118
Size

1.2MB
MD5

21db4ff2a01d4d4d4246aea05b5a9c02
SHA1

6e6e730abf88ef15824e9d00fcb75956943a02d8
SHA256

3af00ccefc81f874be86a1c3a6184b52a75d0cf4f91ab5343d3f9176cfcbd860
SHA512

2e23d1cdbd819f47726a12a7a90b76c430bbc3013cd2ea190d62235bca7453ef3b57db062c516c382d17dd1065a9535a9e222764a0a04596ca9f7bbbefe8a36f
SSDEEP

24576:e845rGHu6gVJKG75oFpA0VWeX4O2y1q2rJp0:745vRVJKGtSA0VWeotu9p0

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

Processes:

resource	yara_rule
/usr/bin/bsd-port/getty	family_mrblack

Executes dropped EXE 2 IoCs

Processes:

getty.sshd

ioc pid process

/usr/bin/bsd-port/getty 1589 getty
/usr/bin/.sshd 1612 .sshd

ioc	pid	process
/usr/bin/bsd-port/getty	1589	getty
/usr/bin/.sshd	1612	.sshd

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

Processes:

getty21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118

description	ioc	process
File opened for modification	/etc/init.d/selinux	getty
File opened for modification	/etc/init.d/DbSecuritySpt	21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118

Write file to user bin folder 1 TTPs 9 IoCs

Hijack Execution Flow

T1574

Processes:

cp21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118gettycpcpcpcpcp

description	ioc	process
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/getty.lock	getty
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/bsd-port/udevd.lock	21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow
T1574

Processes:

cpcp

description ioc process

File opened for modification /bin/ps cp
File opened for modification /bin/ss cp
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

getty21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118

description ioc process

File opened for reading /proc/cpuinfo getty
File opened for reading /proc/cpuinfo 21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118
Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

getty21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118

description ioc process

File opened for reading /proc/net/dev getty
File opened for reading /proc/net/dev 21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118

description	ioc	process
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp

description	ioc	process
File opened for reading	/proc/cpuinfo	getty
File opened for reading	/proc/cpuinfo	21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/dev	getty
File opened for reading	/proc/net/dev	21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118

Reads runtime system information 25 IoCs

Reads data from /proc virtual filesystem.

Processes:

cpmkdirmkdirgettymkdirmkdirmkdirmkdirmkdircpcpmkdircpcpinsmod21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118cpcpmkdirinsmodcpmkdirmkdir

description	ioc	process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo	getty
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/stat	getty
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/meminfo	21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/stat	21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

Processes:

21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118.sshd

description	ioc	process
File opened for modification	/tmp/bill.lock	21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118
File opened for modification	/tmp/gates.lod	21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118
File opened for modification	/tmp/notify.file	21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118
File opened for modification	/tmp/moni.lod	.sshd
File opened for modification	/tmp/notify.file	.sshd
File opened for modification	/tmp/gates.lod	.sshd
File opened for modification	/tmp/moni.lod	21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118

/tmp/21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118
/tmp/21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118
1⤵
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1556

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
2⤵
PID:1571

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
3⤵
PID:1572

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
2⤵
PID:1573

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
3⤵
PID:1574

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
2⤵
PID:1575

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
3⤵
PID:1576

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
2⤵
PID:1577

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
3⤵
PID:1578

/bin/sh
sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
2⤵
PID:1579

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
3⤵
PID:1580

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
2⤵
PID:1581

/bin/mkdir
mkdir -p /usr/bin/bsd-port
3⤵
- Reads runtime system information
PID:1582

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
2⤵
PID:1583

/bin/mkdir
mkdir -p /usr/bin/bsd-port
3⤵
- Reads runtime system information
PID:1584

/bin/sh
sh -c "cp -f /tmp/21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118 /usr/bin/bsd-port/getty"
2⤵
PID:1585

/bin/cp
cp -f /tmp/21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118 /usr/bin/bsd-port/getty
3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1586

/bin/sh
sh -c /usr/bin/bsd-port/getty
2⤵
PID:1588

/usr/bin/bsd-port/getty
/usr/bin/bsd-port/getty
3⤵
- Executes dropped EXE
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
PID:1589

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
4⤵
PID:1597

/bin/ln
ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
5⤵
PID:1598

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
4⤵
PID:1599

/bin/ln
ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
5⤵
PID:1600

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
4⤵
PID:1601

/bin/ln
ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
5⤵
PID:1602

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
4⤵
PID:1603

/bin/ln
ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
5⤵
PID:1604

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
4⤵
PID:1605

/bin/ln
ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
5⤵
PID:1606

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
4⤵
PID:1607

/bin/mkdir
mkdir -p /usr/bin/dpkgd
5⤵
- Reads runtime system information
PID:1608

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
4⤵
PID:1609

/bin/cp
cp -f /bin/ps /usr/bin/dpkgd/ps
5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1613

/bin/sh
sh -c "mkdir -p /bin"
4⤵
PID:1614

/bin/mkdir
mkdir -p /bin
5⤵
- Reads runtime system information
PID:1615

/bin/sh
sh -c "mkdir -p /bin"
4⤵
PID:1616

/bin/mkdir
mkdir -p /bin
5⤵
- Reads runtime system information
PID:1617

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
4⤵
PID:1618

/bin/cp
cp -f /usr/bin/bsd-port/getty /bin/ps
5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1619

/bin/sh
sh -c "chmod 0755 /bin/ps"
4⤵
PID:1620

/bin/chmod
chmod 0755 /bin/ps
5⤵
PID:1621

/bin/sh
sh -c "cp -f /bin/ss /usr/bin/dpkgd/ss"
4⤵
PID:1622

/bin/cp
cp -f /bin/ss /usr/bin/dpkgd/ss
5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1623

/bin/sh
sh -c "mkdir -p /bin"
4⤵
PID:1624

/bin/mkdir
mkdir -p /bin
5⤵
- Reads runtime system information
PID:1625

/bin/sh
sh -c "mkdir -p /bin"
4⤵
PID:1626

/bin/mkdir
mkdir -p /bin
5⤵
- Reads runtime system information
PID:1627

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /bin/ss"
4⤵
PID:1628

/bin/cp
cp -f /usr/bin/bsd-port/getty /bin/ss
5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1629

/bin/sh
sh -c "chmod 0755 /bin/ss"
4⤵
PID:1630

/bin/chmod
chmod 0755 /bin/ss
5⤵
PID:1631

/bin/sh
sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
4⤵
PID:1632

/bin/cp
cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1633

/bin/sh
sh -c "mkdir -p /usr/bin"
4⤵
PID:1634

/bin/mkdir
mkdir -p /usr/bin
5⤵
- Reads runtime system information
PID:1635

/bin/sh
sh -c "mkdir -p /usr/bin"
4⤵
PID:1636

/bin/mkdir
mkdir -p /usr/bin
5⤵
- Reads runtime system information
PID:1637

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
4⤵
PID:1638

/bin/cp
cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1639

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
4⤵
PID:1640

/bin/chmod
chmod 0755 /usr/bin/lsof
5⤵
PID:1641

/bin/sh
sh -c "insmod /usr/bin/bsd-port/xpacket.ko"
4⤵
PID:1644

/sbin/insmod
insmod /usr/bin/bsd-port/xpacket.ko
5⤵
- Reads runtime system information
PID:1645

/bin/sh
sh -c "mkdir -p /usr/bin"
2⤵
PID:1591

/bin/mkdir
mkdir -p /usr/bin
3⤵
- Reads runtime system information
PID:1592

/bin/sh
sh -c "mkdir -p /usr/bin"
2⤵
PID:1593

/bin/mkdir
mkdir -p /usr/bin
3⤵
- Reads runtime system information
PID:1594

/bin/sh
sh -c "cp -f /tmp/21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118 /usr/bin/.sshd"
2⤵
PID:1595

/bin/cp
cp -f /tmp/21db4ff2a01d4d4d4246aea05b5a9c02_JaffaCakes118 /usr/bin/.sshd
3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1596

/bin/sh
sh -c /usr/bin/.sshd
2⤵
PID:1611

/usr/bin/.sshd
/usr/bin/.sshd
3⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1612

/bin/sh
sh -c "insmod /tmp/xpacket.ko"
2⤵
PID:1651

/sbin/insmod
insmod /tmp/xpacket.ko
3⤵
- Reads runtime system information
PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
64B

MD5
6fb9cf8ed8c1f7b071fb3f7b48e5075f

SHA1
caa077ad798a96854b99302226515befeb9ea66c

SHA256
b507802c020792585bbab3716bae2bf2ab6676ae33a8b809d73e4e8b69372b4e

SHA512
b3c0e2eb56dac6408e941fab91b3cb17fc255b1572412f0274ed3e86f8ac4dff573dc4de44bf78fef397812634d6c4b25b091e550925ad3294e587e85707dee7

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/gates.lod

Filesize
4B

MD5
596f713f9a7376fe90a62abaaedecc2d

SHA1
4969de54a08304d642c196ac05d389bbbb255571

SHA256
9e2d999a438d4dc3a1ccdafa1a02c99cbf3716717dcd7b5c75376c194444fba2

SHA512
6cb73b681a281fb6c678edab7c5909c22fb91a285c34a3b1e13f37ea4275c79dd94e364b4f0fd26bf2ae62ca37497550753b4b5801c7a8b6b9998479020419e4

Download Submit
/tmp/moni.lod

Filesize
4B

MD5
81c650caac28cdefce4de5ddc18befa0

SHA1
9be2e9927da42dffd5b76d4d97d612788a4af305

SHA256
b5740f0e88bf42cdae45c073ea5c170e3a422dd3ec257810a29e67b5fafc40c6

SHA512
c698d2f22c81ffcbeb0b7649642d44db03534ec1392f272f4a1bbb75c86e63b6a7a3a5b5dd1a2fdf744a0f67ee9674c2d802aadafc28ebdb0867194ca7fe7faf

Download Submit
/tmp/notify.file

Filesize
51B

MD5
f6eeeea0a867275cb6b863708e0c3846

SHA1
ad037fc04d75c6917d6de2fa8846c0c48db18bba

SHA256
39de7cede1f4866f2089ca7520bdaf608e65bd13da099a6c60da9ec64a75eb94

SHA512
33fb80dd3668d50195172de2ead73ad0c3e6688364098fe20c562a01269e6929753f08797d550366bee179bb940b1e6a5c156fdc28946493e304d297d61cc316

Download Submit
/usr/bin/bsd-port/getty

Filesize
1.2MB

MD5
21db4ff2a01d4d4d4246aea05b5a9c02

SHA1
6e6e730abf88ef15824e9d00fcb75956943a02d8

SHA256
3af00ccefc81f874be86a1c3a6184b52a75d0cf4f91ab5343d3f9176cfcbd860

SHA512
2e23d1cdbd819f47726a12a7a90b76c430bbc3013cd2ea190d62235bca7453ef3b57db062c516c382d17dd1065a9535a9e222764a0a04596ca9f7bbbefe8a36f

Download Submit
/usr/bin/dpkgd/lsof

Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps

Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit
/usr/bin/dpkgd/ss

Filesize
136KB

MD5
1dc929b5f2cd12fe6a2fe71140d2a9e3

SHA1
f9995a92bb201b1b7738a39a38570ef0c40b52d2

SHA256
418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38

SHA512
fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373

Download Submit