mrblack | d1455a563f7766266e9af1767279e3465071f19a970ed2c3562c38e9ffc3f745

Analysis

max time kernel
149s
max time network
148s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
29/07/2024, 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

636903907b2079e63767c8c20c44f9f2_JaffaCakes118
Size

1.1MB
MD5

636903907b2079e63767c8c20c44f9f2
SHA1

9d80149ec93136fe0943ab3e2c58f8d2b5c81cd8
SHA256

d1455a563f7766266e9af1767279e3465071f19a970ed2c3562c38e9ffc3f745
SHA512

f61b5fa3cedc985462a12aa740e84bb65df906cd989edb09033dc5856be80f8244ea749e5a51c7e9de7e8c33bca6ccc4ffd12ee3a4d79084c4e1ad1f1d5d7988
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfa5I+gIGYuuCol7r:4vREKfPqVE5jKsfa5RHGVo7r

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/knerl	1506	knerl
/usr/bin/pythno	1514	pythno

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/init.d/selinux	knerl
File opened for modification	/etc/init.d/VsystemsshMdt	636903907b2079e63767c8c20c44f9f2_JaffaCakes118

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/route	636903907b2079e63767c8c20c44f9f2_JaffaCakes118

Write file to user bin folder 1 TTPs 8 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/bsd-port/udevd.conf	636903907b2079e63767c8c20c44f9f2_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/knerl	cp
File opened for modification	/usr/bin/pythno	cp
File opened for modification	/usr/bin/bsd-port/knerl.conf	knerl
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/knerl.conf	636903907b2079e63767c8c20c44f9f2_JaffaCakes118

Writes file to system bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/ps	cp

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	636903907b2079e63767c8c20c44f9f2_JaffaCakes118
File opened for reading	/proc/cpuinfo	knerl

Reads system network configuration 1 TTPs 4 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/dev	knerl
File opened for reading	/proc/net/dev	636903907b2079e63767c8c20c44f9f2_JaffaCakes118
File opened for reading	/proc/net/route	636903907b2079e63767c8c20c44f9f2_JaffaCakes118
File opened for reading	/proc/net/arp	636903907b2079e63767c8c20c44f9f2_JaffaCakes118

Reads runtime system information 17 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo	636903907b2079e63767c8c20c44f9f2_JaffaCakes118
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	636903907b2079e63767c8c20c44f9f2_JaffaCakes118
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/meminfo	knerl
File opened for reading	/proc/stat	knerl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/idus.log	636903907b2079e63767c8c20c44f9f2_JaffaCakes118
File opened for modification	/tmp/apsh.conf	636903907b2079e63767c8c20c44f9f2_JaffaCakes118
File opened for modification	/tmp/vga.conf	636903907b2079e63767c8c20c44f9f2_JaffaCakes118
File opened for modification	/tmp/notify.file	636903907b2079e63767c8c20c44f9f2_JaffaCakes118
File opened for modification	/tmp/conf.n	636903907b2079e63767c8c20c44f9f2_JaffaCakes118
File opened for modification	/tmp/idus.log	pythno
File opened for modification	/tmp/notify.file	pythno
File opened for modification	/tmp/vga.conf	pythno

/tmp/636903907b2079e63767c8c20c44f9f2_JaffaCakes118
/tmp/636903907b2079e63767c8c20c44f9f2_JaffaCakes118
1⤵
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1477
- /bin/sh
  sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt"
  2⤵
  PID:1490
- - /bin/ln
    ln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt
    3⤵
    PID:1491
- /bin/sh
  sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt"
  2⤵
  PID:1492
- - /bin/ln
    ln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt
    3⤵
    PID:1493
- /bin/sh
  sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt"
  2⤵
  PID:1494
- - /bin/ln
    ln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt
    3⤵
    PID:1495
- /bin/sh
  sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt"
  2⤵
  PID:1496
- - /bin/ln
    ln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt
    3⤵
    PID:1497
- /bin/sh
  sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt"
  2⤵
  PID:1498
- - /bin/ln
    ln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt
    3⤵
    PID:1499
- /bin/sh
  sh -c "mkdir -p /usr/bin/bsd-port"
  2⤵
  PID:1500
- - /bin/mkdir
    mkdir -p /usr/bin/bsd-port
    3⤵
    - Reads runtime system information
    PID:1501
- /bin/sh
  sh -c "cp -f /tmp/636903907b2079e63767c8c20c44f9f2_JaffaCakes118 /usr/bin/bsd-port/knerl"
  2⤵
  PID:1502
- - /bin/cp
    cp -f /tmp/636903907b2079e63767c8c20c44f9f2_JaffaCakes118 /usr/bin/bsd-port/knerl
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1503
- /bin/sh
  sh -c /usr/bin/bsd-port/knerl
  2⤵
  PID:1505
- - /usr/bin/bsd-port/knerl
    /usr/bin/bsd-port/knerl
    3⤵
    - Executes dropped EXE
    - Modifies init.d
    - Write file to user bin folder
    - Checks CPU configuration
    - Reads system network configuration
    - Reads runtime system information
    PID:1506
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
      4⤵
      PID:1525
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
        5⤵
        
        PID:1526
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
      4⤵
      PID:1527
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
        5⤵
        
        PID:1528
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
      4⤵
      PID:1529
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
        5⤵
        
        PID:1530
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
      4⤵
      PID:1531
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
        5⤵
        
        PID:1532
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
      4⤵
      PID:1533
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
        5⤵
        
        PID:1534
  - - /bin/sh
      sh -c "mkdir -p /usr/bin/dpkgd"
      4⤵
      PID:1535
    - - /bin/mkdir
        
        mkdir -p /usr/bin/dpkgd
        5⤵
        Reads runtime system information
        
        PID:1536
  - - /bin/sh
      sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
      4⤵
      PID:1537
    - - /bin/cp
        
        cp -f /bin/ps /usr/bin/dpkgd/ps
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1538
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1539
    - - /bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1540
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/knerl /bin/ps"
      4⤵
      PID:1541
    - - /bin/cp
        
        cp -f /usr/bin/bsd-port/knerl /bin/ps
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1542
  - - /bin/sh
      sh -c "chmod 0755 /bin/ps"
      4⤵
      PID:1543
    - - /bin/chmod
        
        chmod 0755 /bin/ps
        5⤵
        
        PID:1544
  - - /bin/sh
      sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
      4⤵
      PID:1545
    - - /bin/cp
        
        cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1546
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1547
    - - /bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1548
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/knerl /usr/bin/lsof"
      4⤵
      PID:1549
    - - /bin/cp
        
        cp -f /usr/bin/bsd-port/knerl /usr/bin/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1550
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/lsof"
      4⤵
      PID:1551
    - - /bin/chmod
        
        chmod 0755 /usr/bin/lsof
        5⤵
        
        PID:1552
  - - /bin/sh
      sh -c "insmod /usr/lib/xpacket.ko"
      4⤵
      PID:1553
    - - /sbin/insmod
        
        insmod /usr/lib/xpacket.ko
        5⤵
        Reads runtime system information
        
        PID:1554
- /bin/sh
  sh -c "mkdir -p /usr/bin"
  2⤵
  PID:1508
- - /bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:1509
- /bin/sh
  sh -c "cp -f /tmp/636903907b2079e63767c8c20c44f9f2_JaffaCakes118 /usr/bin/pythno"
  2⤵
  PID:1510
- - /bin/cp
    cp -f /tmp/636903907b2079e63767c8c20c44f9f2_JaffaCakes118 /usr/bin/pythno
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1511
- /bin/sh
  sh -c /usr/bin/pythno
  2⤵
  PID:1513
- - /usr/bin/pythno
    /usr/bin/pythno
    3⤵
    - Executes dropped EXE
    - Writes file to tmp directory
    PID:1514
- /bin/sh
  sh -c "insmod /usr/lib/xpacket.ko"
  2⤵
  PID:1516
- - /sbin/insmod
    insmod /usr/lib/xpacket.ko
    3⤵
    - Reads runtime system information
    PID:1517

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/VsystemsshMdt

Filesize
64B

MD5
1d6f3a3f8a347cefffca25c5053bc428

SHA1
1bedfb19500fc556252eb8313ee9acdcb8d149ac

SHA256
c30e976badbeb8ab004e88ef7c5ed77150805f1822892128c5b1821f7ea1fde4

SHA512
a511b27a295335250209a904ad4f7678c0d1358a472bbd0e72d5f5d857e7b3f147d66ead3fc8ef408ab71b8a9a6a56d830afe9b6adbf90823b6750ac9fd9e69f

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
caa27b819c9303446f702929874a00e8

SHA1
d24199c0e376edea3f822b215148cc0dc78364bf

SHA256
da9b535a14c6d9152857e211f14fb8da9056e84ba1b8d4dc27ab79c98264050b

SHA512
dcd9413eb2cb24d77f637edfc00ca0bb42229a1a3b0d84e29eff94a7b91aee6ee8c126c286a4b4103e01834d1c6aec9de09ffab3927e8de8015421005f31446e

Download Submit
/tmp/idus.log

Filesize
4B

MD5
bc7316929fe1545bf0b98d114ee3ecb8

SHA1
7581f9f7cb4e2c129cf3994be96f620fca5eb4c0

SHA256
f1ee529ef49111208f1c1646c53c8c311c9f093fd7891c1b46d77e98210b018d

SHA512
1a177e6a0099bdb0c56b491159fb809bdc3ebe16196a679ee36bb76b54a4aa53145efb9963a5c0ad450df3619c14f1da9fd1a0b3c9e5c063240bffdada51f23b

Download Submit
/tmp/notify.file

Filesize
51B

MD5
1ab1c73732aacd28eca19fac0d7f643d

SHA1
a4ba45eefaa794e9cc701239fe45d2d0fe7ac5c8

SHA256
59a54c46effd91e798c482bcca40c6405af549848e6b3b8ab209f741aedebf35

SHA512
2f5a05a5da1e6591e4cb619a122d480181b416a612eea7a0a9c9b880784f32d4bb0e83491fcd0e95b336620e180626db5c4407964c7727dfe128349ef2437827

Download Submit
/tmp/vga.conf

Filesize
4B

MD5
83cdcec08fbf90370fcf53bdd56604ff

SHA1
6bb0e3b82a69a2bdf7139d17eeb5f79818b92a4d

SHA256
a13df1211cf4c38cdb7a165c67f8e5ab6fded2982c2cb1f55d4cefef880183d5

SHA512
4857999f8e8489709ca2c0f281437e6d1be198dad03232a20b7bccfa61290c371cd8176287a88b9157f74966fb1cecc9db68357d241a08e709d80dfb3426ce42

Download Submit
/usr/bin/bsd-port/knerl

Filesize
1.1MB

MD5
636903907b2079e63767c8c20c44f9f2

SHA1
9d80149ec93136fe0943ab3e2c58f8d2b5c81cd8

SHA256
d1455a563f7766266e9af1767279e3465071f19a970ed2c3562c38e9ffc3f745

SHA512
f61b5fa3cedc985462a12aa740e84bb65df906cd989edb09033dc5856be80f8244ea749e5a51c7e9de7e8c33bca6ccc4ffd12ee3a4d79084c4e1ad1f1d5d7988

Download Submit
/usr/bin/dpkgd/lsof

Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps

Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads