Overview

overview

10

Static

static

10

5fb3a167cd...kes118

ubuntu-22.04-amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5fb3a167cd8e1d7bf2fa5aba1885d6fe_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240729-zrp5hazelp

  • MD5

    5fb3a167cd8e1d7bf2fa5aba1885d6fe

  • SHA1

    f41e8f5d9bf939d06ce68e0178200af96ec0752b

  • SHA256

    5ed4f4153647ba4ba860a06b80748786524a6c923f7323fac9e0033faa673682

  • SHA512

    21767a0fdf7953d9ffc592cee989cf0796bb31fc2916dd3c0de8eaa62c5a1a61a9fcaffa1fa9134d6918a139ec5f69634c394752024d1371a5fb35fae1aed294

  • SSDEEP

    24576:4vRE7caCfKGPqVEDNLFxKsfajI+gIGYuuCol7r:4vREKfPqVE5jKsfajRHGVo7r

Score
10/10
mrblackantivmbotnetlinuxpersistencetrojan

Malware Config

Targets

    • Target

      5fb3a167cd8e1d7bf2fa5aba1885d6fe_JaffaCakes118

    • Size

      1.1MB

    • MD5

      5fb3a167cd8e1d7bf2fa5aba1885d6fe

    • SHA1

      f41e8f5d9bf939d06ce68e0178200af96ec0752b

    • SHA256

      5ed4f4153647ba4ba860a06b80748786524a6c923f7323fac9e0033faa673682

    • SHA512

      21767a0fdf7953d9ffc592cee989cf0796bb31fc2916dd3c0de8eaa62c5a1a61a9fcaffa1fa9134d6918a139ec5f69634c394752024d1371a5fb35fae1aed294

    • SSDEEP

      24576:4vRE7caCfKGPqVEDNLFxKsfajI+gIGYuuCol7r:4vREKfPqVE5jKsfajRHGVo7r

    Score
    10/10
    mrblackantivmbotnetpersistencetrojan

    • MrBlack Trojan

      IoT botnet which infects routers to be used for DDoS attacks.

      trojanbotnetmrblack

    • MrBlack trojan

    • Executes dropped EXE

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Write file to user bin folder

    • Writes file to system bin folder

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks