Overview

overview

10

Static

static

10

0ddda3bb85...kes118

ubuntu-20.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240729-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240729-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    28-07-2024 07:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0ddda3bb8590616f803a7320d890645e_JaffaCakes118

  • Size

    1.5MB

  • MD5

    0ddda3bb8590616f803a7320d890645e

  • SHA1

    60d43f48772248dffd668e58ff3adc05d1dec8d5

  • SHA256

    c2995a7967fc091aa81ca0b203281e8084215ee95bbc4f70d02f334f299f1544

  • SHA512

    1c204103046189329aa694eec4beb99ed3b3c238a0607e4fb5dd64c93122a411fda5a9ae609560d17651654bf53ba042c0a14a9655efa0af9270c360f2d681c8

  • SSDEEP

    24576:GA46TrzJBisiOvhlOHdSbQmHyJgf/kgX0Exb2cyaGpIoiMdhnnLmYXqSYKKZdTrD:zRNi6OHdSbQoyJyXpxb2PaGpXiMbnLmB

Score
10/10
mrblackantivmbotnetpersistencetrojan

Malware Config

Signatures

  • MrBlack Trojan

    IoT botnet which infects routers to be used for DDoS attacks.

    trojanbotnetmrblack
  • MrBlack trojan 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies init.d 1 TTPs 2 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

  • Write file to user bin folder 1 TTPs 9 IoCs
  • Writes file to system bin folder 1 TTPs 2 IoCs
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 4 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 24 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/0ddda3bb8590616f803a7320d890645e_JaffaCakes118
    /tmp/0ddda3bb8590616f803a7320d890645e_JaffaCakes118
    1⤵
    • Modifies init.d
    • Reads system routing table
    • Write file to user bin folder
    • Checks CPU configuration
    • Reads system network configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1353
    • /bin/sh
      sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
      2⤵
        PID:1359
        • /usr/bin/ln
          ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
          3⤵
            PID:1360
        • /bin/sh
          sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
          2⤵
            PID:1361
            • /usr/bin/ln
              ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
              3⤵
                PID:1362
            • /bin/sh
              sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
              2⤵
                PID:1363
                • /usr/bin/ln
                  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
                  3⤵
                    PID:1364
                • /bin/sh
                  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
                  2⤵
                    PID:1365
                    • /usr/bin/ln
                      ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
                      3⤵
                        PID:1366
                    • /bin/sh
                      sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
                      2⤵
                        PID:1367
                        • /usr/bin/ln
                          ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
                          3⤵
                            PID:1368
                        • /bin/sh
                          sh -c "mkdir -p /usr/bin/bsd-port"
                          2⤵
                            PID:1369
                            • /usr/bin/mkdir
                              mkdir -p /usr/bin/bsd-port
                              3⤵
                              • Reads runtime system information
                              PID:1370
                          • /bin/sh
                            sh -c "cp -f /tmp/0ddda3bb8590616f803a7320d890645e_JaffaCakes118 /usr/bin/bsd-port/getty"
                            2⤵
                              PID:1371
                              • /usr/bin/cp
                                cp -f /tmp/0ddda3bb8590616f803a7320d890645e_JaffaCakes118 /usr/bin/bsd-port/getty
                                3⤵
                                • Write file to user bin folder
                                • Reads runtime system information
                                PID:1372
                            • /bin/sh
                              sh -c /usr/bin/bsd-port/getty
                              2⤵
                                PID:1374
                                • /usr/bin/bsd-port/getty
                                  /usr/bin/bsd-port/getty
                                  3⤵
                                  • Executes dropped EXE
                                  • Modifies init.d
                                  • Write file to user bin folder
                                  • Checks CPU configuration
                                  • Reads system network configuration
                                  • Reads runtime system information
                                  PID:1375
                                  • /bin/sh
                                    sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
                                    4⤵
                                      PID:1396
                                      • /usr/bin/ln
                                        ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
                                        5⤵
                                          PID:1397
                                      • /bin/sh
                                        sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
                                        4⤵
                                          PID:1398
                                          • /usr/bin/ln
                                            ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
                                            5⤵
                                              PID:1399
                                          • /bin/sh
                                            sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
                                            4⤵
                                              PID:1400
                                              • /usr/bin/ln
                                                ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
                                                5⤵
                                                  PID:1401
                                              • /bin/sh
                                                sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
                                                4⤵
                                                  PID:1402
                                                  • /usr/bin/ln
                                                    ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
                                                    5⤵
                                                      PID:1403
                                                  • /bin/sh
                                                    sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
                                                    4⤵
                                                      PID:1404
                                                      • /usr/bin/ln
                                                        ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
                                                        5⤵
                                                          PID:1405
                                                      • /bin/sh
                                                        sh -c "mkdir -p /usr/bin/dpkgd"
                                                        4⤵
                                                          PID:1406
                                                          • /usr/bin/mkdir
                                                            mkdir -p /usr/bin/dpkgd
                                                            5⤵
                                                            • Reads runtime system information
                                                            PID:1407
                                                        • /bin/sh
                                                          sh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"
                                                          4⤵
                                                            PID:1408
                                                            • /usr/bin/cp
                                                              cp -f /bin/lsof /usr/bin/dpkgd/lsof
                                                              5⤵
                                                              • Write file to user bin folder
                                                              • Reads runtime system information
                                                              PID:1409
                                                          • /bin/sh
                                                            sh -c "mkdir -p /bin"
                                                            4⤵
                                                              PID:1410
                                                              • /usr/bin/mkdir
                                                                mkdir -p /bin
                                                                5⤵
                                                                • Reads runtime system information
                                                                PID:1411
                                                            • /bin/sh
                                                              sh -c "cp -f /usr/bin/bsd-port/getty /bin/lsof"
                                                              4⤵
                                                                PID:1412
                                                                • /usr/bin/cp
                                                                  cp -f /usr/bin/bsd-port/getty /bin/lsof
                                                                  5⤵
                                                                  • Writes file to system bin folder
                                                                  • Reads runtime system information
                                                                  PID:1413
                                                              • /bin/sh
                                                                sh -c "chmod 0755 /bin/lsof"
                                                                4⤵
                                                                  PID:1414
                                                                  • /usr/bin/chmod
                                                                    chmod 0755 /bin/lsof
                                                                    5⤵
                                                                      PID:1415
                                                                  • /bin/sh
                                                                    sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
                                                                    4⤵
                                                                      PID:1416
                                                                      • /usr/bin/cp
                                                                        cp -f /bin/ps /usr/bin/dpkgd/ps
                                                                        5⤵
                                                                        • Write file to user bin folder
                                                                        • Reads runtime system information
                                                                        PID:1417
                                                                    • /bin/sh
                                                                      sh -c "mkdir -p /bin"
                                                                      4⤵
                                                                        PID:1418
                                                                        • /usr/bin/mkdir
                                                                          mkdir -p /bin
                                                                          5⤵
                                                                          • Reads runtime system information
                                                                          PID:1419
                                                                      • /bin/sh
                                                                        sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
                                                                        4⤵
                                                                          PID:1420
                                                                          • /usr/bin/cp
                                                                            cp -f /usr/bin/bsd-port/getty /bin/ps
                                                                            5⤵
                                                                            • Writes file to system bin folder
                                                                            • Reads runtime system information
                                                                            PID:1421
                                                                        • /bin/sh
                                                                          sh -c "chmod 0755 /bin/ps"
                                                                          4⤵
                                                                            PID:1422
                                                                            • /usr/bin/chmod
                                                                              chmod 0755 /bin/ps
                                                                              5⤵
                                                                                PID:1423
                                                                            • /bin/sh
                                                                              sh -c "mkdir -p /usr/bin"
                                                                              4⤵
                                                                                PID:1424
                                                                                • /usr/bin/mkdir
                                                                                  mkdir -p /usr/bin
                                                                                  5⤵
                                                                                  • Reads runtime system information
                                                                                  PID:1425
                                                                              • /bin/sh
                                                                                sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
                                                                                4⤵
                                                                                  PID:1426
                                                                                  • /usr/bin/cp
                                                                                    cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
                                                                                    5⤵
                                                                                    • Write file to user bin folder
                                                                                    • Reads runtime system information
                                                                                    PID:1427
                                                                                • /bin/sh
                                                                                  sh -c "chmod 0755 /usr/bin/lsof"
                                                                                  4⤵
                                                                                    PID:1430
                                                                                    • /usr/bin/chmod
                                                                                      chmod 0755 /usr/bin/lsof
                                                                                      5⤵
                                                                                        PID:1431
                                                                                    • /bin/sh
                                                                                      sh -c "mkdir -p /usr/bin"
                                                                                      4⤵
                                                                                        PID:1432
                                                                                        • /usr/bin/mkdir
                                                                                          mkdir -p /usr/bin
                                                                                          5⤵
                                                                                          • Reads runtime system information
                                                                                          PID:1433
                                                                                      • /bin/sh
                                                                                        sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ps"
                                                                                        4⤵
                                                                                          PID:1434
                                                                                          • /usr/bin/cp
                                                                                            cp -f /usr/bin/bsd-port/getty /usr/bin/ps
                                                                                            5⤵
                                                                                            • Write file to user bin folder
                                                                                            • Reads runtime system information
                                                                                            PID:1435
                                                                                        • /bin/sh
                                                                                          sh -c "chmod 0755 /usr/bin/ps"
                                                                                          4⤵
                                                                                            PID:1436
                                                                                            • /usr/bin/chmod
                                                                                              chmod 0755 /usr/bin/ps
                                                                                              5⤵
                                                                                                PID:1437
                                                                                            • /bin/sh
                                                                                              sh -c "insmod /usr/lib/xpacket.ko"
                                                                                              4⤵
                                                                                                PID:1438
                                                                                                • /usr/sbin/insmod
                                                                                                  insmod /usr/lib/xpacket.ko
                                                                                                  5⤵
                                                                                                  • Reads runtime system information
                                                                                                  PID:1439
                                                                                          • /bin/sh
                                                                                            sh -c "mkdir -p /usr/bin"
                                                                                            2⤵
                                                                                              PID:1377
                                                                                              • /usr/bin/mkdir
                                                                                                mkdir -p /usr/bin
                                                                                                3⤵
                                                                                                • Reads runtime system information
                                                                                                PID:1378
                                                                                            • /bin/sh
                                                                                              sh -c "cp -f /tmp/0ddda3bb8590616f803a7320d890645e_JaffaCakes118 /usr/bin/l1bhr"
                                                                                              2⤵
                                                                                                PID:1379
                                                                                                • /usr/bin/cp
                                                                                                  cp -f /tmp/0ddda3bb8590616f803a7320d890645e_JaffaCakes118 /usr/bin/l1bhr
                                                                                                  3⤵
                                                                                                  • Write file to user bin folder
                                                                                                  • Reads runtime system information
                                                                                                  PID:1380
                                                                                              • /bin/sh
                                                                                                sh -c /usr/bin/l1bhr
                                                                                                2⤵
                                                                                                  PID:1382
                                                                                                  • /usr/bin/l1bhr
                                                                                                    /usr/bin/l1bhr
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Reads runtime system information
                                                                                                    • Writes file to tmp directory
                                                                                                    PID:1383
                                                                                                • /bin/sh
                                                                                                  sh -c "insmod /usr/lib/xpacket.ko"
                                                                                                  2⤵
                                                                                                    PID:1386
                                                                                                    • /usr/sbin/insmod
                                                                                                      insmod /usr/lib/xpacket.ko
                                                                                                      3⤵
                                                                                                      • Reads runtime system information
                                                                                                      PID:1387

                                                                                                Network

                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • /etc/init.d/DbSecuritySpt
                                                                                                  Filesize

                                                                                                  64B

                                                                                                  MD5

                                                                                                  4bfa88b3a1aaba0e59f8715f2d2e44d5

                                                                                                  SHA1

                                                                                                  7a0deb3288964582e8f9c18c2cc21250a36bf0f3

                                                                                                  SHA256

                                                                                                  386b3beb39971ee5eae0313a4815eac2826f3ba294bbc7d50a3420f8921a77c8

                                                                                                  SHA512

                                                                                                  6790558e1cab4d822bfdbc76a217b258187b72ff47658ae0d232930787f606c55c40cce53e02bba0eb13387c99ac1fa1a976917edef006d6baff784be5287bbc

                                                                                                  Download Submit

                                                                                                • /etc/init.d/selinux
                                                                                                  Filesize

                                                                                                  36B

                                                                                                  MD5

                                                                                                  993cc15058142d96c3daf7852c3d5ee8

                                                                                                  SHA1

                                                                                                  0950b8b391b04dd3895ea33cd3141543ebd2525d

                                                                                                  SHA256

                                                                                                  8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

                                                                                                  SHA512

                                                                                                  0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

                                                                                                  Download Submit

                                                                                                • /tmp/gates.lock
                                                                                                  Filesize

                                                                                                  4B

                                                                                                  MD5

                                                                                                  af4732711661056eadbf798ba191272a

                                                                                                  SHA1

                                                                                                  397d13d9aee3ce3572a22022f4c50cf8553a668a

                                                                                                  SHA256

                                                                                                  d5b148567313dccf2ecad36152900c51a967603c18fda39cc3c3771b76df0325

                                                                                                  SHA512

                                                                                                  2e19e7bc5785fb2f8bbf591030b40c757494c2cc7a62aa7ee0288589a70f05bbbed832d476c52baa60e20a7660553bbbdae2f9973f6c566ddb398dd269cb1276

                                                                                                  Download Submit

                                                                                                • /tmp/moni.lock
                                                                                                  Filesize

                                                                                                  4B

                                                                                                  MD5

                                                                                                  5ca3e9b122f61f8f06494c97b1afccf3

                                                                                                  SHA1

                                                                                                  58907516874aa70188525b2518faf0e285fd821a

                                                                                                  SHA256

                                                                                                  a73531f89e6bcbc2a72a8b08ac33122114e19ffbf89d9dc7d3ef0e85f5dc2287

                                                                                                  SHA512

                                                                                                  56408a6ba3549a362ab752432ab61e25f11acc3401431f7cdf90d9780a9967450526c2f53c529f4b12581844bc4bf9814573a87b0d89a69b3ccc568bcfefc361

                                                                                                  Download Submit

                                                                                                • /tmp/notify.file
                                                                                                  Filesize

                                                                                                  51B

                                                                                                  MD5

                                                                                                  2a90fe5f453a5f1409ab187c3dbf9ae2

                                                                                                  SHA1

                                                                                                  40173eae87b8c58cb84ae4a927a6d209970ac7f9

                                                                                                  SHA256

                                                                                                  a99d1377c71f2ad14d8359b43acfc2e5a03ae63bf7a430017a5c2e8c91b23845

                                                                                                  SHA512

                                                                                                  13e115d05f76028836682eefc9eb2f67c903bc5d19294e1cca6cc56636fd3d8d948da9e363a79fb09da14544eebae5ede66d4f4b8ba05fbdbe500ffa4b662112

                                                                                                  Download Submit

                                                                                                • /usr/bin/bsd-port/getty
                                                                                                  Filesize

                                                                                                  1.5MB

                                                                                                  MD5

                                                                                                  0ddda3bb8590616f803a7320d890645e

                                                                                                  SHA1

                                                                                                  60d43f48772248dffd668e58ff3adc05d1dec8d5

                                                                                                  SHA256

                                                                                                  c2995a7967fc091aa81ca0b203281e8084215ee95bbc4f70d02f334f299f1544

                                                                                                  SHA512

                                                                                                  1c204103046189329aa694eec4beb99ed3b3c238a0607e4fb5dd64c93122a411fda5a9ae609560d17651654bf53ba042c0a14a9655efa0af9270c360f2d681c8

                                                                                                  Download Submit

                                                                                                • /usr/bin/dpkgd/lsof
                                                                                                  Filesize

                                                                                                  171KB

                                                                                                  MD5

                                                                                                  061386937ec7acf924438a2643a32be0

                                                                                                  SHA1

                                                                                                  01a044b9e58839bea3e58c66cb32acc16241bf91

                                                                                                  SHA256

                                                                                                  8a26bbae9eb85aa98ef29cfe5b0a291234db6eb394c3e0c2841983dcf7dda959

                                                                                                  SHA512

                                                                                                  2de2e56ac4c32f47b4a1945ccfb0db378e6d59019ee8004e3e5d2ec8935efb5aa8ee14b8a0b21c61a267e195d42a3232a6dcade8720de06118fd579277f59db7

                                                                                                  Download Submit

                                                                                                • /usr/bin/dpkgd/ps
                                                                                                  Filesize

                                                                                                  134KB

                                                                                                  MD5

                                                                                                  d194576b899af45b1d2a448612ec21e5

                                                                                                  SHA1

                                                                                                  492f7d8f28cd4397ce22fcf0d8bf3304ea93465a

                                                                                                  SHA256

                                                                                                  a8cf81f3a1137c999c3cf336507ce120b3065e633ade01db6280d427b7d986ca

                                                                                                  SHA512

                                                                                                  b323babd9580b91772cde29c9f22ae75b27f5ce8ce0268a48ca41713c3545dd72409932a5c48f6af66ac6e43127eb5461d1f686bd667fa1b0e56a1564db3c539

                                                                                                  Download Submit