mrblack | feae327b591a0bfda987bfd51c03d7ffe2d2f2a5e1c4746f84ab5c56e26cfb34

General

Target

1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118
Size

1.1MB
MD5

1667e92adf34ba91e26b75d8faf7c934
SHA1

d9795a5894f120aa45f808c640d854a3743a858b
SHA256

feae327b591a0bfda987bfd51c03d7ffe2d2f2a5e1c4746f84ab5c56e26cfb34
SHA512

9637815d7d5a6800686cccefbca0a3e9b167f20453ee8fc648a729c545298f01543cd47b8696cb28d729701ffd2fd261e85ab92299a15ba6691c4eeda9e50792
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfalI+gIGYuuCol7r:4vREKfPqVE5jKsfalRHGVo7r

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

Processes:

resource	yara_rule
/usr/bin/bsd-port/knerl	family_mrblack

Executes dropped EXE 2 IoCs

Processes:

knerlpythno

ioc pid process

/usr/bin/bsd-port/knerl 1533 knerl
/usr/bin/pythno 1541 pythno

ioc	pid	process
/usr/bin/bsd-port/knerl	1533	knerl
/usr/bin/pythno	1541	pythno

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

Processes:

1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118knerl

description	ioc	process
File opened for modification	/etc/init.d/VsystemsshMdt	1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118
File opened for modification	/etc/init.d/selinux	knerl

Write file to user bin folder 1 TTPs 9 IoCs

Hijack Execution Flow

T1574

Processes:

1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118cpcpcpcpknerlcpcp

description	ioc	process
File opened for modification	/usr/bin/bsd-port/knerl.conf	1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/knerl	cp
File opened for modification	/usr/bin/pythno	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/udevd.conf	1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/knerl.conf	knerl
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/ps	cp

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow
T1574

Processes:

cpcp

description ioc process

File opened for modification /bin/lsof cp
File opened for modification /bin/ps cp
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118knerl

description ioc process

File opened for reading /proc/cpuinfo 1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118
File opened for reading /proc/cpuinfo knerl
Reads system network configuration 1 TTPs 2 IoCs
Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery
T1016

Processes:

1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118knerl

description ioc process

File opened for reading /proc/net/dev 1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118
File opened for reading /proc/net/dev knerl

description	ioc	process
File opened for modification	/bin/lsof	cp
File opened for modification	/bin/ps	cp

description	ioc	process
File opened for reading	/proc/cpuinfo	1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118
File opened for reading	/proc/cpuinfo	knerl

description	ioc	process
File opened for reading	/proc/net/dev	1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118
File opened for reading	/proc/net/dev	knerl

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

Processes:

1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118cpcpknerlmkdirinsmodcpmkdirmkdirpythnocpmkdircpcpmkdirinsmodmkdircpmkdircp

description	ioc	process
File opened for reading	/proc/sys/kernel/version	1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118
File opened for reading	/proc/meminfo	1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/meminfo	knerl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/version	pythno
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/stat	knerl
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/version	knerl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

Processes:

1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118pythno

description	ioc	process
File opened for modification	/tmp/apsh.conf	1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118
File opened for modification	/tmp/vga.conf	1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118
File opened for modification	/tmp/notify.file	1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118
File opened for modification	/tmp/idus.log	pythno
File opened for modification	/tmp/notify.file	pythno
File opened for modification	/tmp/vga.conf	pythno
File opened for modification	/tmp/idus.log	1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118

/tmp/1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118
/tmp/1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118
1⤵
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1511

/bin/sh
sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt"
2⤵
PID:1517

/usr/bin/ln
ln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt
3⤵
PID:1518

/bin/sh
sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt"
2⤵
PID:1519

/usr/bin/ln
ln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt
3⤵
PID:1520

/bin/sh
sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt"
2⤵
PID:1521

/usr/bin/ln
ln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt
3⤵
PID:1522

/bin/sh
sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt"
2⤵
PID:1523

/usr/bin/ln
ln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt
3⤵
PID:1524

/bin/sh
sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt"
2⤵
PID:1525

/usr/bin/ln
ln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt
3⤵
PID:1526

/bin/sh
sh -c "mkdir -p /usr/bin/bsd-port"
2⤵
PID:1527

/usr/bin/mkdir
mkdir -p /usr/bin/bsd-port
3⤵
- Reads runtime system information
PID:1528

/bin/sh
sh -c "cp -f /tmp/1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118 /usr/bin/bsd-port/knerl"
2⤵
PID:1529

/usr/bin/cp
cp -f /tmp/1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118 /usr/bin/bsd-port/knerl
3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1530

/bin/sh
sh -c /usr/bin/bsd-port/knerl
2⤵
PID:1532

/usr/bin/bsd-port/knerl
/usr/bin/bsd-port/knerl
3⤵
- Executes dropped EXE
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
PID:1533

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
4⤵
PID:1549

/usr/bin/ln
ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
5⤵
PID:1550

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
4⤵
PID:1551

/usr/bin/ln
ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
5⤵
PID:1552

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
4⤵
PID:1553

/usr/bin/ln
ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
5⤵
PID:1554

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
4⤵
PID:1555

/usr/bin/ln
ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
5⤵
PID:1556

/bin/sh
sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
4⤵
PID:1557

/usr/bin/ln
ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
5⤵
PID:1558

/bin/sh
sh -c "mkdir -p /usr/bin/dpkgd"
4⤵
PID:1559

/usr/bin/mkdir
mkdir -p /usr/bin/dpkgd
5⤵
- Reads runtime system information
PID:1560

/bin/sh
sh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"
4⤵
PID:1562

/usr/bin/cp
cp -f /bin/lsof /usr/bin/dpkgd/lsof
5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1563

/bin/sh
sh -c "mkdir -p /bin"
4⤵
PID:1564

/usr/bin/mkdir
mkdir -p /bin
5⤵
- Reads runtime system information
PID:1565

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/knerl /bin/lsof"
4⤵
PID:1566

/usr/bin/cp
cp -f /usr/bin/bsd-port/knerl /bin/lsof
5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1567

/bin/sh
sh -c "chmod 0755 /bin/lsof"
4⤵
PID:1569

/usr/bin/chmod
chmod 0755 /bin/lsof
5⤵
PID:1570

/bin/sh
sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
4⤵
PID:1571

/usr/bin/cp
cp -f /bin/ps /usr/bin/dpkgd/ps
5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1572

/bin/sh
sh -c "mkdir -p /bin"
4⤵
PID:1573

/usr/bin/mkdir
mkdir -p /bin
5⤵
- Reads runtime system information
PID:1574

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/knerl /bin/ps"
4⤵
PID:1575

/usr/bin/cp
cp -f /usr/bin/bsd-port/knerl /bin/ps
5⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1576

/bin/sh
sh -c "chmod 0755 /bin/ps"
4⤵
PID:1578

/usr/bin/chmod
chmod 0755 /bin/ps
5⤵
PID:1579

/bin/sh
sh -c "mkdir -p /usr/bin"
4⤵
PID:1580

/usr/bin/mkdir
mkdir -p /usr/bin
5⤵
- Reads runtime system information
PID:1581

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/knerl /usr/bin/lsof"
4⤵
PID:1582

/usr/bin/cp
cp -f /usr/bin/bsd-port/knerl /usr/bin/lsof
5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1583

/bin/sh
sh -c "chmod 0755 /usr/bin/lsof"
4⤵
PID:1585

/usr/bin/chmod
chmod 0755 /usr/bin/lsof
5⤵
PID:1586

/bin/sh
sh -c "mkdir -p /usr/bin"
4⤵
PID:1587

/usr/bin/mkdir
mkdir -p /usr/bin
5⤵
- Reads runtime system information
PID:1588

/bin/sh
sh -c "cp -f /usr/bin/bsd-port/knerl /usr/bin/ps"
4⤵
PID:1589

/usr/bin/cp
cp -f /usr/bin/bsd-port/knerl /usr/bin/ps
5⤵
- Write file to user bin folder
- Reads runtime system information
PID:1590

/bin/sh
sh -c "chmod 0755 /usr/bin/ps"
4⤵
PID:1591

/usr/bin/chmod
chmod 0755 /usr/bin/ps
5⤵
PID:1592

/bin/sh
sh -c "insmod /usr/lib/xpacket.ko"
4⤵
PID:1593

/usr/sbin/insmod
insmod /usr/lib/xpacket.ko
5⤵
- Reads runtime system information
PID:1594

/bin/sh
sh -c "mkdir -p /usr/bin"
2⤵
PID:1535

/usr/bin/mkdir
mkdir -p /usr/bin
3⤵
- Reads runtime system information
PID:1536

/bin/sh
sh -c "cp -f /tmp/1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118 /usr/bin/pythno"
2⤵
PID:1537

/usr/bin/cp
cp -f /tmp/1667e92adf34ba91e26b75d8faf7c934_JaffaCakes118 /usr/bin/pythno
3⤵
- Write file to user bin folder
- Reads runtime system information
PID:1538

/bin/sh
sh -c /usr/bin/pythno
2⤵
PID:1540

/usr/bin/pythno
/usr/bin/pythno
3⤵
- Executes dropped EXE
- Reads runtime system information
- Writes file to tmp directory
PID:1541

/bin/sh
sh -c "insmod /usr/lib/xpacket.ko"
2⤵
PID:1543

/usr/sbin/insmod
insmod /usr/lib/xpacket.ko
3⤵
- Reads runtime system information
PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Hijack Execution Flow

2

T1574

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Hijack Execution Flow

2

T1574

Defense Evasion

Hijack Execution Flow

2

T1574

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/VsystemsshMdt

Filesize
64B

MD5
e3b2763e5b7be4354078bbf0e13b4de7

SHA1
3f0e230604c892cf6db35419da2026c557eee217

SHA256
ded4cc774f0706e818ffabfdb194dddb82e522b0458a3ac8bded842e8fe0dafb

SHA512
f58ca4743f13c0d12fd6b73bd725ece383d2c23f763b1ab8580f3fa61847ac8edb2d08e1d805fe0fd8f55648f0108d2575980c044e884f1f9c5973a57fa17e1d

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
caa27b819c9303446f702929874a00e8

SHA1
d24199c0e376edea3f822b215148cc0dc78364bf

SHA256
da9b535a14c6d9152857e211f14fb8da9056e84ba1b8d4dc27ab79c98264050b

SHA512
dcd9413eb2cb24d77f637edfc00ca0bb42229a1a3b0d84e29eff94a7b91aee6ee8c126c286a4b4103e01834d1c6aec9de09ffab3927e8de8015421005f31446e

Download Submit
/tmp/idus.log

Filesize
4B

MD5
d010396ca8abf6ead8cacc2c2f2f26c7

SHA1
731df0fc93417f72fcb56f09cd754f9382ae6373

SHA256
596d0c702ba6d20835982c87a878f97d07a163285a0a3ee98c6e7a8e0459a8cb

SHA512
843da40f223209d8e90012e1a35004387636ffcb23cce0602a3964055ed790d271e5fd274351b8dd3afc4200e0a9d28811f7a0987f44d813e4257f10dedabeba

Download Submit
/tmp/notify.file

Filesize
51B

MD5
63bfcaf5a40bce7693e60566610f6f64

SHA1
c4bc5230e7b899b5ec97d38bf96e9ac34b56c6c3

SHA256
947ec30d769d9d64163b12802fe20982459bbb2be5044b225ab5e224d5bfc7d8

SHA512
a9d8791ff48e813002769cdc7fe1cd78469d30db34b9cada28596dc0f44a20a6a693d095cd8a70817dabfcea5398af57edcac5897ed44230cb6701236e797c65

Download Submit
/tmp/vga.conf

Filesize
4B

MD5
0f3d014eead934bbdbacb62a01dc4831

SHA1
443233bf934850484d12f21d9603a36ee83d1dfb

SHA256
66c03337b22c301d55a339a94165dc09628491c3dfe01a57ef62e3eab452e898

SHA512
30e3cef49700596aa4b725177f0fca3f38355d0c45a445c6d176e9e3a4ecf4ca7bdde2a3dfaceb9f67b74bc145bb816bf3daad9414080bcb859c62de097e4b9b

Download Submit
/usr/bin/bsd-port/knerl

Filesize
1.1MB

MD5
1667e92adf34ba91e26b75d8faf7c934

SHA1
d9795a5894f120aa45f808c640d854a3743a858b

SHA256
feae327b591a0bfda987bfd51c03d7ffe2d2f2a5e1c4746f84ab5c56e26cfb34

SHA512
9637815d7d5a6800686cccefbca0a3e9b167f20453ee8fc648a729c545298f01543cd47b8696cb28d729701ffd2fd261e85ab92299a15ba6691c4eeda9e50792

Download Submit
/usr/bin/dpkgd/lsof

Filesize
163KB

MD5
ab57b66cc531ae0f996963223e632b60

SHA1
bf7e5becd33f21c2539f5a75ffa0ab61c49c8795

SHA256
2484863a7bfda7f97b90bfd5dfceed4ec9f27dd51f9c5158c8daabbf4309b1df

SHA512
908acef13f3c1d80b7169ec3b16bb67006013453348fff75550bc3c6c2137e798b21d7990edbd5be63d756d9c41b06160aebf38aa80547e4bafa3a62596057f6

Download Submit
/usr/bin/dpkgd/ps

Filesize
138KB

MD5
8146139c2ad7e550b1d1f49480997446

SHA1
074db8890c3227bd8a588417f5b9bde637bcf3af

SHA256
207df9d438f75185ab3af2ab1173d104831a6631c28ef40d38b2ab43de27b40f

SHA512
b6d71d537f593b9af833e6f798e412e95fc486a313414ed8cca9639f61be7ac9dca700e9f861c0d07c7f65b3783127a67f829f422472cad8938ba01d397ab9de

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads