Analysis
-
max time kernel
149s -
max time network
145s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240729-en -
resource tags
-
submitted
29-07-2024 11:16
General
-
Target
43195a0298bcc72b72f5687d4bd49c37_JaffaCakes118
-
Size
1.1MB
-
MD5
43195a0298bcc72b72f5687d4bd49c37
-
SHA1
90ea668fc256ee75f803da35bad44589cd2caddf
-
SHA256
43056c0ce96c83c1c21263fd163f9a59156cbab1b5b7b713a4409ba5feeb7a7d
-
SHA512
8b169b0f24e2676f05110df630c1a1df40d2b89176ebfcfd7ca59678cfad992b2ff152c041c93c1ea66d2f6be64a3a9adf99b67cc59d582ec14a3c207ab421a1
-
SSDEEP
24576:4vRE7caCfKGPqVEDNLFxKsfa/I+gIGYuuCol7r:4vREKfPqVE5jKsfa/RHGVo7r
Malware Config
Signatures
-
MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
-
MrBlack trojan 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Modifies init.d 1 TTPs 2 IoCs
Adds/modifies system service, likely for persistence.
-
Reads system routing table 1 TTPs 1 IoCs
Gets active network interfaces from /proc virtual filesystem.
-
Write file to user bin folder 1 TTPs 8 IoCs
-
Writes file to system bin folder 1 TTPs 1 IoCs
-
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads system network configuration 1 TTPs 4 IoCs
Uses contents of /proc filesystem to enumerate network settings.
-
Reads runtime system information 17 IoCs
Reads data from /proc virtual filesystem.
-
Writes file to tmp directory 8 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/43195a0298bcc72b72f5687d4bd49c37_JaffaCakes118/tmp/43195a0298bcc72b72f5687d4bd49c37_JaffaCakes1181⤵
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc1.d/S97VsystemsshMmt"2⤵
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc1.d/S97VsystemsshMmt3⤵
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc2.d/S97VsystemsshMmt"2⤵
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc2.d/S97VsystemsshMmt3⤵
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc3.d/S97VsystemsshMmt"2⤵
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc3.d/S97VsystemsshMmt3⤵
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc4.d/S97VsystemsshMmt"2⤵
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc4.d/S97VsystemsshMmt3⤵
-
/bin/shsh -c "ln -s /etc/init.d/VsystemsshMmt /etc/rc5.d/S97VsystemsshMmt"2⤵
-
/bin/lnln -s /etc/init.d/VsystemsshMmt /etc/rc5.d/S97VsystemsshMmt3⤵
-
/bin/shsh -c "mkdir -p /usr/bin/bsd-port"2⤵
-
/bin/mkdirmkdir -p /usr/bin/bsd-port3⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /tmp/43195a0298bcc72b72f5687d4bd49c37_JaffaCakes118 /usr/bin/bsd-port/recei"2⤵
-
/bin/cpcp -f /tmp/43195a0298bcc72b72f5687d4bd49c37_JaffaCakes118 /usr/bin/bsd-port/recei3⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c /usr/bin/bsd-port/recei2⤵
-
/usr/bin/bsd-port/recei/usr/bin/bsd-port/recei3⤵
- Executes dropped EXE
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"4⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc1.d/S99selinux5⤵
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"4⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc2.d/S99selinux5⤵
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"4⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc3.d/S99selinux5⤵
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"4⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc4.d/S99selinux5⤵
-
/bin/shsh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"4⤵
-
/bin/lnln -s /etc/init.d/selinux /etc/rc5.d/S99selinux5⤵
-
/bin/shsh -c "mkdir -p /usr/bin/dpkgd"4⤵
-
/bin/mkdirmkdir -p /usr/bin/dpkgd5⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"4⤵
-
/bin/cpcp -f /bin/ps /usr/bin/dpkgd/ps5⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /bin"4⤵
-
/bin/mkdirmkdir -p /bin5⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/recei /bin/ps"4⤵
-
/bin/cpcp -f /usr/bin/bsd-port/recei /bin/ps5⤵
- Writes file to system bin folder
- Reads runtime system information
-
/bin/shsh -c "chmod 0755 /bin/ps"4⤵
-
/bin/chmodchmod 0755 /bin/ps5⤵
-
/bin/shsh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"4⤵
-
/bin/cpcp -f /usr/bin/lsof /usr/bin/dpkgd/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /usr/bin"4⤵
-
/bin/mkdirmkdir -p /usr/bin5⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /usr/bin/bsd-port/recei /usr/bin/lsof"4⤵
-
/bin/cpcp -f /usr/bin/bsd-port/recei /usr/bin/lsof5⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c "chmod 0755 /usr/bin/lsof"4⤵
-
/bin/chmodchmod 0755 /usr/bin/lsof5⤵
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"4⤵
-
/sbin/insmodinsmod /usr/lib/xpacket.ko5⤵
- Reads runtime system information
-
/bin/shsh -c "mkdir -p /usr/bin"2⤵
-
/bin/mkdirmkdir -p /usr/bin3⤵
- Reads runtime system information
-
/bin/shsh -c "cp -f /tmp/43195a0298bcc72b72f5687d4bd49c37_JaffaCakes118 /usr/bin/oracle"2⤵
-
/bin/cpcp -f /tmp/43195a0298bcc72b72f5687d4bd49c37_JaffaCakes118 /usr/bin/oracle3⤵
- Write file to user bin folder
- Reads runtime system information
-
/bin/shsh -c /usr/bin/oracle2⤵
-
/usr/bin/oracle/usr/bin/oracle3⤵
- Executes dropped EXE
- Writes file to tmp directory
-
/bin/shsh -c "insmod /usr/lib/xpacket.ko"2⤵
-
/sbin/insmodinsmod /usr/lib/xpacket.ko3⤵
- Reads runtime system information
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64B
MD54198ac992e1ec9aa0cae9c25b1490245
SHA10548a5119c503868b32ede5bb8f6eb162ab35551
SHA256abd4a93bae07c39187dd36d5c4d3636efd6bfddcd6de7ef8986e476d6fe1c0ac
SHA512269397d5217b45604df19db2af11279ef61864628f502e288870cfa7be5c4f3875d5adba10f885187d658d7cb5c23e8c59dc880acf045d85c705ff63ed5169f3
-
Filesize
36B
MD557cde9c165195cfb90c212057795ed49
SHA1d77d9895306eb09ad9b54588fb7998c79c671563
SHA2563e3488e9c63dfadffd594301e2192418b158238bfb8f83d6702123d72892cf36
SHA512de9af53a508167cbbb820a99c2742918ec5b8c83877b77e43e4b441019311685647f47fb4666ba53ecef4e6a2d5514eb67981d471ddf173b04848609b3c0c00d
-
Filesize
4B
MD54e6cd95227cb0c280e99a195be5f6615
SHA100b7858a85fe7328455145a1552e17378e980fe7
SHA2561e61da9318ad5f39fa341ffa808659430fd708a76917b50851a1fbcf88375f1e
SHA51205b75cc64fa98271a6f55bf355457eea5a2ac6ef5a340774c8cc55e7ce2f574d1b0aef783abb46975ed6b930c479762a2e89c487438a696722e4079c84b81490
-
Filesize
51B
MD54f712a65d720258634b361c992cbff18
SHA12eb8e4307c50bcfb73d156c51e067caab5ba7192
SHA256625765b3c033b6dc601f3d46a5a72bfc3e38effa8c106bd1100456e2f2e19902
SHA5123026df2edba31f478261bb676573701ce88e0ed596c734b8aa98f9c77f96a886ca8fef2df229410e3e6584ece38ebdc6c1fc3350ae191993074406ba575c793a
-
Filesize
1.1MB
MD543195a0298bcc72b72f5687d4bd49c37
SHA190ea668fc256ee75f803da35bad44589cd2caddf
SHA25643056c0ce96c83c1c21263fd163f9a59156cbab1b5b7b713a4409ba5feeb7a7d
SHA5128b169b0f24e2676f05110df630c1a1df40d2b89176ebfcfd7ca59678cfad992b2ff152c041c93c1ea66d2f6be64a3a9adf99b67cc59d582ec14a3c207ab421a1
-
Filesize
159KB
MD5e093dc78225e2a0a25e3b137c1c1e442
SHA1c29497cfaae729eb576875e4fdfa400640ab16be
SHA2561190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
SHA512fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
-
Filesize
130KB
MD5558edc26f8a38fa9788220b9af8a73e7
SHA13024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA256b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
SHA512edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f