mrblack | c18ea407518d1556077a6d050a84ab0c4617cc61e813cee4ba1d89255e81f63d

Analysis

max time kernel
149s
max time network
131s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
29-07-2024 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118
Size

1.1MB
MD5

5ac7d41ad646c1d305b014ca0ef3a544
SHA1

46a8e3e70e0b8e1ac1b70074b502343a4c4dc8b0
SHA256

c18ea407518d1556077a6d050a84ab0c4617cc61e813cee4ba1d89255e81f63d
SHA512

45aa041b21bea8f1ea2a99af19ee8e467deaf2cdbdb857af193e2c07e4fd5fe7d6a2002a5d642073bb231c96cf09dad67b529dd86cbf69252d15c725d70cc5a1
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfazI+gIGYuuCol7r:4vREKfPqVE5jKsfazRHGVo7r

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/knerl	1524	knerl
/usr/bin/.sshd	1532	.sshd

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/init.d/QsystemsshMmt	5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118
File opened for modification	/etc/init.d/selinux	knerl

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/route	5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118

Write file to user bin folder 1 TTPs 8 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/bsd-port/knerl.conf	knerl
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/knerl.conf	5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/udevd.conf	5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/knerl	cp

Writes file to system bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/ps	cp

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118
File opened for reading	/proc/cpuinfo	knerl

Reads system network configuration 1 TTPs 4 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/dev	5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118
File opened for reading	/proc/net/dev	knerl
File opened for reading	/proc/net/route	5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118
File opened for reading	/proc/net/arp	5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118

Reads runtime system information 17 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/meminfo	5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo	knerl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	knerl
File opened for reading	/proc/cmdline	insmod

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/notify.file	5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118
File opened for modification	/tmp/appq.log	.sshd
File opened for modification	/tmp/notify.file	.sshd
File opened for modification	/tmp/conf.n	5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118
File opened for modification	/tmp/Dest.cfg	.sshd
File opened for modification	/tmp/appq.log	5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118
File opened for modification	/tmp/appq.conf	5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118
File opened for modification	/tmp/Dest.cfg	5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118

/tmp/5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118
/tmp/5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118
1⤵
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1503
- /bin/sh
  sh -c "ln -s /etc/init.d/QsystemsshMmt /etc/rc1.d/S97QsystemsshMmt"
  2⤵
  PID:1508
- - /bin/ln
    ln -s /etc/init.d/QsystemsshMmt /etc/rc1.d/S97QsystemsshMmt
    3⤵
    PID:1509
- /bin/sh
  sh -c "ln -s /etc/init.d/QsystemsshMmt /etc/rc2.d/S97QsystemsshMmt"
  2⤵
  PID:1510
- - /bin/ln
    ln -s /etc/init.d/QsystemsshMmt /etc/rc2.d/S97QsystemsshMmt
    3⤵
    PID:1511
- /bin/sh
  sh -c "ln -s /etc/init.d/QsystemsshMmt /etc/rc3.d/S97QsystemsshMmt"
  2⤵
  PID:1512
- - /bin/ln
    ln -s /etc/init.d/QsystemsshMmt /etc/rc3.d/S97QsystemsshMmt
    3⤵
    PID:1513
- /bin/sh
  sh -c "ln -s /etc/init.d/QsystemsshMmt /etc/rc4.d/S97QsystemsshMmt"
  2⤵
  PID:1514
- - /bin/ln
    ln -s /etc/init.d/QsystemsshMmt /etc/rc4.d/S97QsystemsshMmt
    3⤵
    PID:1515
- /bin/sh
  sh -c "ln -s /etc/init.d/QsystemsshMmt /etc/rc5.d/S97QsystemsshMmt"
  2⤵
  PID:1516
- - /bin/ln
    ln -s /etc/init.d/QsystemsshMmt /etc/rc5.d/S97QsystemsshMmt
    3⤵
    PID:1517
- /bin/sh
  sh -c "mkdir -p /usr/bin/bsd-port"
  2⤵
  PID:1518
- - /bin/mkdir
    mkdir -p /usr/bin/bsd-port
    3⤵
    - Reads runtime system information
    PID:1519
- /bin/sh
  sh -c "cp -f /tmp/5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118 /usr/bin/bsd-port/knerl"
  2⤵
  PID:1520
- - /bin/cp
    cp -f /tmp/5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118 /usr/bin/bsd-port/knerl
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1521
- /bin/sh
  sh -c /usr/bin/bsd-port/knerl
  2⤵
  PID:1523
- - /usr/bin/bsd-port/knerl
    /usr/bin/bsd-port/knerl
    3⤵
    - Executes dropped EXE
    - Modifies init.d
    - Write file to user bin folder
    - Checks CPU configuration
    - Reads system network configuration
    - Reads runtime system information
    PID:1524
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
      4⤵
      PID:1539
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
        5⤵
        
        PID:1540
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
      4⤵
      PID:1541
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
        5⤵
        
        PID:1542
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
      4⤵
      PID:1543
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
        5⤵
        
        PID:1544
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
      4⤵
      PID:1545
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
        5⤵
        
        PID:1546
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
      4⤵
      PID:1547
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
        5⤵
        
        PID:1548
  - - /bin/sh
      sh -c "mkdir -p /usr/bin/dpkgd"
      4⤵
      PID:1549
    - - /bin/mkdir
        
        mkdir -p /usr/bin/dpkgd
        5⤵
        Reads runtime system information
        
        PID:1550
  - - /bin/sh
      sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
      4⤵
      PID:1551
    - - /bin/cp
        
        cp -f /bin/ps /usr/bin/dpkgd/ps
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1552
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1553
    - - /bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1554
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/knerl /bin/ps"
      4⤵
      PID:1555
    - - /bin/cp
        
        cp -f /usr/bin/bsd-port/knerl /bin/ps
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1556
  - - /bin/sh
      sh -c "chmod 0755 /bin/ps"
      4⤵
      PID:1558
    - - /bin/chmod
        
        chmod 0755 /bin/ps
        5⤵
        
        PID:1559
  - - /bin/sh
      sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
      4⤵
      PID:1560
    - - /bin/cp
        
        cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1561
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1562
    - - /bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1563
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/knerl /usr/bin/lsof"
      4⤵
      PID:1564
    - - /bin/cp
        
        cp -f /usr/bin/bsd-port/knerl /usr/bin/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1565
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/lsof"
      4⤵
      PID:1567
    - - /bin/chmod
        
        chmod 0755 /usr/bin/lsof
        5⤵
        
        PID:1568
  - - /bin/sh
      sh -c "insmod /usr/lib/xpacket.ko"
      4⤵
      PID:1569
    - - /sbin/insmod
        
        insmod /usr/lib/xpacket.ko
        5⤵
        Reads runtime system information
        
        PID:1570
- /bin/sh
  sh -c "mkdir -p /usr/bin"
  2⤵
  PID:1526
- - /bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:1527
- /bin/sh
  sh -c "cp -f /tmp/5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118 /usr/bin/.sshd"
  2⤵
  PID:1528
- - /bin/cp
    cp -f /tmp/5ac7d41ad646c1d305b014ca0ef3a544_JaffaCakes118 /usr/bin/.sshd
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1529
- /bin/sh
  sh -c /usr/bin/.sshd
  2⤵
  PID:1531
- - /usr/bin/.sshd
    /usr/bin/.sshd
    3⤵
    - Executes dropped EXE
    - Writes file to tmp directory
    PID:1532
- /bin/sh
  sh -c "insmod /usr/lib/xpacket.ko"
  2⤵
  PID:1534
- - /sbin/insmod
    insmod /usr/lib/xpacket.ko
    3⤵
    - Reads runtime system information
    PID:1535

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/QsystemsshMmt

Filesize
64B

MD5
50dafa9a1c757e2a4deb0ee632694fe0

SHA1
6766f18fd9e0e7f54b2d25efee62eaf816e12721

SHA256
35c886b9a41c40c4462645ee21a48ec7aacddf834f0509578f7d8f495887f906

SHA512
b0a1d65a6ebac3ea28bf70935d4395e322c239ec069c95244ebecf4ac227066d735fa74df7def3aab31be5916aa884c659fd0c2901459914e2dc6cef68602e39

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
caa27b819c9303446f702929874a00e8

SHA1
d24199c0e376edea3f822b215148cc0dc78364bf

SHA256
da9b535a14c6d9152857e211f14fb8da9056e84ba1b8d4dc27ab79c98264050b

SHA512
dcd9413eb2cb24d77f637edfc00ca0bb42229a1a3b0d84e29eff94a7b91aee6ee8c126c286a4b4103e01834d1c6aec9de09ffab3927e8de8015421005f31446e

Download Submit
/tmp/Dest.cfg

Filesize
4B

MD5
49b8b4f95f02e055801da3b4f58e28b7

SHA1
cf9e834770ba6c82d76e63220ee31818c4752951

SHA256
3ec13115817a014a621e22b052993c86ed03ed69114f8413888f302d70e2d216

SHA512
938a677a2bc46d49b94ed854509e0dd9011531be60a84d5adb3dc2da442f3dea627908ae967e346c7b0defeaa938888108a501573a3a7824f2421142f9316ecf

Download Submit
/tmp/notify.file

Filesize
51B

MD5
d8baf807a7254cd51f7eee5ae20edf12

SHA1
6c2bb3fac85ab36cd99a0e442190242a06ff1abe

SHA256
827a7fea21ee138174afec191a81fd0e145878381a16af85f5f829debdac7f55

SHA512
9bce02e00654c58497b4a963bbabdd30e539511c3fa970df7ec69f48ab832932dcde1633a28291cae0d5fe279c42b92aaf79d5e4b0fe14881c348d4d5775a84e

Download Submit
/usr/bin/bsd-port/knerl

Filesize
1.1MB

MD5
5ac7d41ad646c1d305b014ca0ef3a544

SHA1
46a8e3e70e0b8e1ac1b70074b502343a4c4dc8b0

SHA256
c18ea407518d1556077a6d050a84ab0c4617cc61e813cee4ba1d89255e81f63d

SHA512
45aa041b21bea8f1ea2a99af19ee8e467deaf2cdbdb857af193e2c07e4fd5fe7d6a2002a5d642073bb231c96cf09dad67b529dd86cbf69252d15c725d70cc5a1

Download Submit
/usr/bin/dpkgd/lsof

Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps

Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads