mrblack | 08d910fbe0c24f0e12a186a013129ecb07e907ae3331a8d069545e97d3f80c11

Analysis

max time kernel
149s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28-07-2024 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e05896b109cab25b5dd680cbf416015_JaffaCakes118
Size

1.1MB
MD5

0e05896b109cab25b5dd680cbf416015
SHA1

1819164e6668fe23fe32f71a3d255e6c1189ca5e
SHA256

08d910fbe0c24f0e12a186a013129ecb07e907ae3331a8d069545e97d3f80c11
SHA512

29826f90d653e6cec31bbe844847d6bad6f16ec1b447b417c3e42d7deec4467df303457a82332c37ff70f2c1698629246fd182eb6c5fb3d9dae1c45d093633f2
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfaUI+gIGYuuCol7r:4vREKfPqVE5jKsfaURHGVo7r

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	1532	getty
/usr/bin/.sshd	1540	.sshd

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/init.d/DbSecuritySpt	0e05896b109cab25b5dd680cbf416015_JaffaCakes118
File opened for modification	/etc/init.d/selinux	getty

Write file to user bin folder 1 TTPs 8 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/bsd-port/udevd.lock	0e05896b109cab25b5dd680cbf416015_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	getty
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	0e05896b109cab25b5dd680cbf416015_JaffaCakes118

Writes file to system bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/ps	cp

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	0e05896b109cab25b5dd680cbf416015_JaffaCakes118
File opened for reading	/proc/cpuinfo	getty

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/dev	0e05896b109cab25b5dd680cbf416015_JaffaCakes118
File opened for reading	/proc/net/dev	getty

Reads runtime system information 17 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/stat	0e05896b109cab25b5dd680cbf416015_JaffaCakes118
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/meminfo	getty
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	getty
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo	0e05896b109cab25b5dd680cbf416015_JaffaCakes118
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bill.lock	0e05896b109cab25b5dd680cbf416015_JaffaCakes118
File opened for modification	/tmp/gates.lock	0e05896b109cab25b5dd680cbf416015_JaffaCakes118
File opened for modification	/tmp/notify.file	0e05896b109cab25b5dd680cbf416015_JaffaCakes118
File opened for modification	/tmp/moni.lock	.sshd
File opened for modification	/tmp/notify.file	.sshd
File opened for modification	/tmp/gates.lock	.sshd
File opened for modification	/tmp/moni.lock	0e05896b109cab25b5dd680cbf416015_JaffaCakes118

/tmp/0e05896b109cab25b5dd680cbf416015_JaffaCakes118
/tmp/0e05896b109cab25b5dd680cbf416015_JaffaCakes118
1⤵
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1504
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
  2⤵
  PID:1516
- - /bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
    3⤵
    PID:1517
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
  2⤵
  PID:1518
- - /bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
    3⤵
    PID:1519
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
  2⤵
  PID:1520
- - /bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
    3⤵
    PID:1521
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
  2⤵
  PID:1522
- - /bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
    3⤵
    PID:1523
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
  2⤵
  PID:1524
- - /bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
    3⤵
    PID:1525
- /bin/sh
  sh -c "mkdir -p /usr/bin/bsd-port"
  2⤵
  PID:1526
- - /bin/mkdir
    mkdir -p /usr/bin/bsd-port
    3⤵
    - Reads runtime system information
    PID:1527
- /bin/sh
  sh -c "cp -f /tmp/0e05896b109cab25b5dd680cbf416015_JaffaCakes118 /usr/bin/bsd-port/getty"
  2⤵
  PID:1528
- - /bin/cp
    cp -f /tmp/0e05896b109cab25b5dd680cbf416015_JaffaCakes118 /usr/bin/bsd-port/getty
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1529
- /bin/sh
  sh -c /usr/bin/bsd-port/getty
  2⤵
  PID:1531
- - /usr/bin/bsd-port/getty
    /usr/bin/bsd-port/getty
    3⤵
    - Executes dropped EXE
    - Modifies init.d
    - Write file to user bin folder
    - Checks CPU configuration
    - Reads system network configuration
    - Reads runtime system information
    PID:1532
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
      4⤵
      PID:1547
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
        5⤵
        
        PID:1548
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
      4⤵
      PID:1549
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
        5⤵
        
        PID:1550
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
      4⤵
      PID:1551
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
        5⤵
        
        PID:1552
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
      4⤵
      PID:1553
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
        5⤵
        
        PID:1554
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
      4⤵
      PID:1555
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
        5⤵
        
        PID:1556
  - - /bin/sh
      sh -c "mkdir -p /usr/bin/dpkgd"
      4⤵
      PID:1557
    - - /bin/mkdir
        
        mkdir -p /usr/bin/dpkgd
        5⤵
        Reads runtime system information
        
        PID:1558
  - - /bin/sh
      sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
      4⤵
      PID:1559
    - - /bin/cp
        
        cp -f /bin/ps /usr/bin/dpkgd/ps
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1560
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1561
    - - /bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1562
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
      4⤵
      PID:1563
    - - /bin/cp
        
        cp -f /usr/bin/bsd-port/getty /bin/ps
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1564
  - - /bin/sh
      sh -c "chmod 0755 /bin/ps"
      4⤵
      PID:1566
    - - /bin/chmod
        
        chmod 0755 /bin/ps
        5⤵
        
        PID:1567
  - - /bin/sh
      sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
      4⤵
      PID:1568
    - - /bin/cp
        
        cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1569
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1570
    - - /bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1571
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
      4⤵
      PID:1572
    - - /bin/cp
        
        cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1573
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/lsof"
      4⤵
      PID:1575
    - - /bin/chmod
        
        chmod 0755 /usr/bin/lsof
        5⤵
        
        PID:1576
  - - /bin/sh
      sh -c "insmod /usr/lib/xpacket.ko"
      4⤵
      PID:1577
    - - /sbin/insmod
        
        insmod /usr/lib/xpacket.ko
        5⤵
        Reads runtime system information
        
        PID:1578
- /bin/sh
  sh -c "mkdir -p /usr/bin"
  2⤵
  PID:1534
- - /bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:1535
- /bin/sh
  sh -c "cp -f /tmp/0e05896b109cab25b5dd680cbf416015_JaffaCakes118 /usr/bin/.sshd"
  2⤵
  PID:1536
- - /bin/cp
    cp -f /tmp/0e05896b109cab25b5dd680cbf416015_JaffaCakes118 /usr/bin/.sshd
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1537
- /bin/sh
  sh -c /usr/bin/.sshd
  2⤵
  PID:1539
- - /usr/bin/.sshd
    /usr/bin/.sshd
    3⤵
    - Executes dropped EXE
    - Writes file to tmp directory
    PID:1540
- /bin/sh
  sh -c "insmod /usr/lib/xpacket.ko"
  2⤵
  PID:1542
- - /sbin/insmod
    insmod /usr/lib/xpacket.ko
    3⤵
    - Reads runtime system information
    PID:1543

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
64B

MD5
82fe7bae215ac9e965841ab9092a9231

SHA1
68dec5b06304482f932ec84d02eac3992d5ebfb6

SHA256
eb49096879a0fded44397539d6b8d1794373ad1b1b9c2b6b377e47f903d81b67

SHA512
d9dfb0da395658ce45cad205e251ebe9b96368d9302db71c775a11903213187cc015779c458b033433125411581fb76642d501198b148ee7e87d490917f47b4f

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/gates.lock

Filesize
4B

MD5
0c9ebb2ded806d7ffda75cd0b95eb70c

SHA1
9492dfa1e0a89d7e4fab574112c048faf6ef87b3

SHA256
755917ecbc61091ffa6b605d7f82bdaa4e4cbdc309124807b0fb63228d0696df

SHA512
fd1f0dd6c5175ab1fe3be9a1ed4a5f0fabe02a799f5de59b303b44dec219f5b43434aed40b8d9674dd55435ae5b9eec6aa7bc7db982b7d526ab57128511340ea

Download Submit
/tmp/moni.lock

Filesize
4B

MD5
1373b284bc381890049e92d324f56de0

SHA1
d05785002742a30502dde3731b28883334e46040

SHA256
477e2d13152129e72c4a47a5abed06ce422daff2ca0e99d33bc527477effee34

SHA512
b409dbef7cad909beab9e2b251590e7a6773e6ef7bc3782a9adb4be3a2765fdefca68cb96b9b31e92e0edb23d521aa3adfb7c90ade660e75b1a04832d19d59f4

Download Submit
/tmp/notify.file

Filesize
51B

MD5
53abef7a7041e9c326e7dacd41dece59

SHA1
7a976356e7a9608dd5164e444d136841c7de25ba

SHA256
d4082f8e6a8df35109f647bd96a0533555feb24529cf76aa3160180d9fc3d285

SHA512
3ff5f7c8345eae677be7b50226f3834d6a26af77895a1b0706780af5993dc2db4287e04364a7cad4023207f20f51a76935091027916fc7ee6846afe398550871

Download Submit
/usr/bin/bsd-port/getty

Filesize
1.1MB

MD5
0e05896b109cab25b5dd680cbf416015

SHA1
1819164e6668fe23fe32f71a3d255e6c1189ca5e

SHA256
08d910fbe0c24f0e12a186a013129ecb07e907ae3331a8d069545e97d3f80c11

SHA512
29826f90d653e6cec31bbe844847d6bad6f16ec1b447b417c3e42d7deec4467df303457a82332c37ff70f2c1698629246fd182eb6c5fb3d9dae1c45d093633f2

Download Submit
/usr/bin/dpkgd/lsof

Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps

Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads