mrblack | c90fef14d8b59c7c037acbcd310a0985f6053ebbefbd8e1f3b6f873c62fe1a8c

Analysis

max time kernel
149s
max time network
149s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
28-07-2024 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118
Size

1.1MB
MD5

0ab61a2da442f3f3c44e18e8e4e57892
SHA1

99a1baef2afd91cb86aac6758a7f4ff86981c6b0
SHA256

c90fef14d8b59c7c037acbcd310a0985f6053ebbefbd8e1f3b6f873c62fe1a8c
SHA512

c69d516d8952de63901d730183c8e5df5980495a525d8b75bf846908b722aae6a5948094743aaafd83af454ec26b7d1ad0e9dc61099a9766e8d15ab57bc8e141
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfaCI+gIGYuuCol7r:4vREKfPqVE5jKsfaCRHGVo7r

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/agent	1530	agent
/usr/bin/acpid	1538	acpid

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/init.d/DbSecurityMdt	0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118
File opened for modification	/etc/init.d/selinux	agent

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/route	agent

Write file to user bin folder 1 TTPs 10 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/bsd-port/agent.conf	0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/udevd.conf	0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118
File opened for modification	/usr/bin/acpid	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/bsd-port/conf.n	agent
File opened for modification	/usr/bin/bsd-port/agent	cp
File opened for modification	/usr/bin/bsd-port/agent.conf	agent
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/ps	cp

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/ps	cp
File opened for modification	/bin/lsof	cp

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118
File opened for reading	/proc/cpuinfo	agent

Reads system network configuration 1 TTPs 4 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/dev	0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118
File opened for reading	/proc/net/dev	agent
File opened for reading	/proc/net/route	agent
File opened for reading	/proc/net/arp	agent

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/meminfo	0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo	agent
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/version	acpid
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/stat	agent
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/sys/kernel/version	0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118
File opened for reading	/proc/sys/kernel/version	agent
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/notify.file	acpid
File opened for modification	/tmp/gates.note	acpid
File opened for modification	/tmp/moni.note	0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118
File opened for modification	/tmp/bill.note	0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118
File opened for modification	/tmp/gates.note	0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118
File opened for modification	/tmp/notify.file	0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118
File opened for modification	/tmp/moni.note	acpid

/tmp/0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118
/tmp/0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118
1⤵
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1508
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc1.d/S97DbSecurityMdt"
  2⤵
  PID:1514
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecurityMdt /etc/rc1.d/S97DbSecurityMdt
    3⤵
    PID:1515
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc2.d/S97DbSecurityMdt"
  2⤵
  PID:1516
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecurityMdt /etc/rc2.d/S97DbSecurityMdt
    3⤵
    PID:1517
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc3.d/S97DbSecurityMdt"
  2⤵
  PID:1518
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecurityMdt /etc/rc3.d/S97DbSecurityMdt
    3⤵
    PID:1519
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc4.d/S97DbSecurityMdt"
  2⤵
  PID:1520
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecurityMdt /etc/rc4.d/S97DbSecurityMdt
    3⤵
    PID:1521
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc5.d/S97DbSecurityMdt"
  2⤵
  PID:1522
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecurityMdt /etc/rc5.d/S97DbSecurityMdt
    3⤵
    PID:1523
- /bin/sh
  sh -c "mkdir -p /usr/bin/bsd-port"
  2⤵
  PID:1524
- - /usr/bin/mkdir
    mkdir -p /usr/bin/bsd-port
    3⤵
    - Reads runtime system information
    PID:1525
- /bin/sh
  sh -c "cp -f /tmp/0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118 /usr/bin/bsd-port/agent"
  2⤵
  PID:1526
- - /usr/bin/cp
    cp -f /tmp/0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118 /usr/bin/bsd-port/agent
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1527
- /bin/sh
  sh -c /usr/bin/bsd-port/agent
  2⤵
  PID:1529
- - /usr/bin/bsd-port/agent
    /usr/bin/bsd-port/agent
    3⤵
    - Executes dropped EXE
    - Modifies init.d
    - Reads system routing table
    - Write file to user bin folder
    - Checks CPU configuration
    - Reads system network configuration
    - Reads runtime system information
    PID:1530
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
      4⤵
      PID:1545
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
        5⤵
        
        PID:1546
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
      4⤵
      PID:1547
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
        5⤵
        
        PID:1548
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
      4⤵
      PID:1550
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
        5⤵
        
        PID:1551
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
      4⤵
      PID:1552
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
        5⤵
        
        PID:1553
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
      4⤵
      PID:1554
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
        5⤵
        
        PID:1555
  - - /bin/sh
      sh -c "mkdir -p /usr/bin/dpkgd"
      4⤵
      PID:1556
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin/dpkgd
        5⤵
        Reads runtime system information
        
        PID:1557
  - - /bin/sh
      sh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"
      4⤵
      PID:1558
    - - /usr/bin/cp
        
        cp -f /bin/lsof /usr/bin/dpkgd/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1559
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1561
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1562
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/agent /bin/lsof"
      4⤵
      PID:1563
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/agent /bin/lsof
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1564
  - - /bin/sh
      sh -c "chmod 0755 /bin/lsof"
      4⤵
      PID:1565
    - - /usr/bin/chmod
        
        chmod 0755 /bin/lsof
        5⤵
        
        PID:1566
  - - /bin/sh
      sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
      4⤵
      PID:1567
    - - /usr/bin/cp
        
        cp -f /bin/ps /usr/bin/dpkgd/ps
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1568
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1570
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1571
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/agent /bin/ps"
      4⤵
      PID:1572
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/agent /bin/ps
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1573
  - - /bin/sh
      sh -c "chmod 0755 /bin/ps"
      4⤵
      PID:1574
    - - /usr/bin/chmod
        
        chmod 0755 /bin/ps
        5⤵
        
        PID:1575
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1576
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1578
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/agent /usr/bin/lsof"
      4⤵
      PID:1579
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/agent /usr/bin/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1580
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/lsof"
      4⤵
      PID:1581
    - - /usr/bin/chmod
        
        chmod 0755 /usr/bin/lsof
        5⤵
        
        PID:1582
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1583
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1584
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/agent /usr/bin/ps"
      4⤵
      PID:1586
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/agent /usr/bin/ps
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1587
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/ps"
      4⤵
      PID:1588
    - - /usr/bin/chmod
        
        chmod 0755 /usr/bin/ps
        5⤵
        
        PID:1589
  - - /bin/sh
      sh -c "insmod /usr/lib/xpacket.ko"
      4⤵
      PID:1590
    - - /usr/sbin/insmod
        
        insmod /usr/lib/xpacket.ko
        5⤵
        Reads runtime system information
        
        PID:1591
- /bin/sh
  sh -c "mkdir -p /usr/bin"
  2⤵
  PID:1532
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:1533
- /bin/sh
  sh -c "cp -f /tmp/0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118 /usr/bin/acpid"
  2⤵
  PID:1534
- - /usr/bin/cp
    cp -f /tmp/0ab61a2da442f3f3c44e18e8e4e57892_JaffaCakes118 /usr/bin/acpid
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1535
- /bin/sh
  sh -c /usr/bin/acpid
  2⤵
  PID:1537
- - /usr/bin/acpid
    /usr/bin/acpid
    3⤵
    - Executes dropped EXE
    - Reads runtime system information
    - Writes file to tmp directory
    PID:1538
- /bin/sh
  sh -c "insmod /usr/lib/xpacket.ko"
  2⤵
  PID:1540
- - /usr/sbin/insmod
    insmod /usr/lib/xpacket.ko
    3⤵
    - Reads runtime system information
    PID:1541

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecurityMdt

Filesize
64B

MD5
1f0bbd13fcc4f9a32d533b9a02c49785

SHA1
5ca03f378b8acc7d7b96611ce0e944f14d21959b

SHA256
8c43280f667f96aa041cabdd809c60e53b40a53005b7da00a488a7ffad3dac3f

SHA512
bb4c52a1f01d583f0c487b724f37ec6f08801008b51854b72dce9e36f6c41a170c470f2ed6a24685077d6e69faa3d62ed83533ad5a5000c10a76d291536bcc6d

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
c6a80f08539a4c3176762f514976dd24

SHA1
bbc5826b01d20f5c4d315ff5dbc3f216760c64ef

SHA256
ea47e885ae227059ce55d020335f7869c565ec6d85f484497e83cd4998149d5d

SHA512
9a1e3b0142876305fe389e07880bd586e97bf709273a66299d9128ff2861459104054d4e5d836aecdf73f2c11886fa3a2a8498741adb3211b96116658b856175

Download Submit
/tmp/gates.note

Filesize
4B

MD5
1cd3882394520876dc88d1472aa2a93f

SHA1
ea2cc4f43528792dd726473df61a0a9ddb13952f

SHA256
7054d0451000f27e0673c136e684b10beee8f4d6d9d04f964a92345a92cb17ef

SHA512
ae4d3015a8503f655ce41937f3a51022f3b9b9fedd80a8ab2201c38f3dfbd1b80a9fc44a88084770e1647c45c23d7f167cc0c2c328074e963c973f9b1439eff4

Download Submit
/tmp/moni.note

Filesize
4B

MD5
17e23e50bedc63b4095e3d8204ce063b

SHA1
464f9d1621f0799f4c4b7a2e884b21e4be81d222

SHA256
731d65cdd441fde25333a70782a078911af63ef672e299a906030e16ff66756b

SHA512
500dc81d5bd51e4e1bfa0ccfd7922d2c1da081a86844cd976c5c9e0d896dd78ec1631324cb634142875271e66c4800f8631a7d6dcef2ab5705f758d7e38dd7c3

Download Submit
/tmp/notify.file

Filesize
51B

MD5
14e0a1936921bd794f320f6cd9ef0411

SHA1
5a9a1f4145053f768e64f413ca993b28a6202ad9

SHA256
9f4b8cd3629c3c2699353c02812ff0042fd94da0a06c1a2766fa5b2c4dce7a5c

SHA512
98b08db4ed47d63636989e5855b6d2e226764bac07219f1c12c0a4f64d0102c5b1e24420df24e06ceeaddf62cf74d156efd882ca85ea8053d56fb14cb37e7de5

Download Submit
/usr/bin/bsd-port/agent

Filesize
1.1MB

MD5
0ab61a2da442f3f3c44e18e8e4e57892

SHA1
99a1baef2afd91cb86aac6758a7f4ff86981c6b0

SHA256
c90fef14d8b59c7c037acbcd310a0985f6053ebbefbd8e1f3b6f873c62fe1a8c

SHA512
c69d516d8952de63901d730183c8e5df5980495a525d8b75bf846908b722aae6a5948094743aaafd83af454ec26b7d1ad0e9dc61099a9766e8d15ab57bc8e141

Download Submit
/usr/bin/bsd-port/conf.n

Filesize
69B

MD5
1de0561dcc3dcd84ecd3165cba19afb0

SHA1
ddd4eea99a3da3984d097b0e69685301be6e01d2

SHA256
93870836ad5fc6fd4154855f241da8b905107c021aa8146afb264993aa7c1ec9

SHA512
eb23f4f28e0c701d1074e9a6177de986f0ecb9bd4858b67d099dee56da16bbf2a82f9a2d50f823509a524eaeaa2f032b874817d3601c679ac07b9c580611340c

Download Submit
/usr/bin/dpkgd/lsof

Filesize
163KB

MD5
ab57b66cc531ae0f996963223e632b60

SHA1
bf7e5becd33f21c2539f5a75ffa0ab61c49c8795

SHA256
2484863a7bfda7f97b90bfd5dfceed4ec9f27dd51f9c5158c8daabbf4309b1df

SHA512
908acef13f3c1d80b7169ec3b16bb67006013453348fff75550bc3c6c2137e798b21d7990edbd5be63d756d9c41b06160aebf38aa80547e4bafa3a62596057f6

Download Submit
/usr/bin/dpkgd/ps

Filesize
138KB

MD5
8146139c2ad7e550b1d1f49480997446

SHA1
074db8890c3227bd8a588417f5b9bde637bcf3af

SHA256
207df9d438f75185ab3af2ab1173d104831a6631c28ef40d38b2ab43de27b40f

SHA512
b6d71d537f593b9af833e6f798e412e95fc486a313414ed8cca9639f61be7ac9dca700e9f861c0d07c7f65b3783127a67f829f422472cad8938ba01d397ab9de

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads