Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    ubuntu-22.04_amd64
  • resource
    ubuntu2204-amd64-20240729-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
  • submitted
    30-07-2024 01:54

General

  • Target

    6e2e71eec8d4c018d70f33c15621aa35_JaffaCakes118

  • Size

    1.5MB

  • MD5

    6e2e71eec8d4c018d70f33c15621aa35

  • SHA1

    c83935da847a5eeff1152565cdb79e1129cf4e00

  • SHA256

    98811afe3b43cebb55cf7e70463622dc66e020edf5b0d39d198438abf7740814

  • SHA512

    664defc7f27f4cb9445b24c298f35f559c089ea5847be62db9bfc7384b970bd620235f7a2f81d6ad5d7e41c0f1bca4b4f358fdd98e7764e2d96aa91106490c31

  • SSDEEP

    24576:GA46TrzJBisiOvhlOHdSbQmHyJgf/kgX0Exb2cyaGpIoiMAnnLmYXqSYKKZdTrnD:zRNi6OHdSbQoyJyXpxb2PaGpXiMAnLmB

Malware Config

Signatures

  • MrBlack Trojan

    IoT botnet which infects routers to be used for DDoS attacks.

  • MrBlack trojan 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies init.d 1 TTPs 2 IoCs

    Adds/modifies system service, likely for persistence.

  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

  • Write file to user bin folder 1 TTPs 9 IoCs
  • Writes file to system bin folder 1 TTPs 2 IoCs
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Reads system network configuration 1 TTPs 4 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

  • Reads runtime system information 24 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/6e2e71eec8d4c018d70f33c15621aa35_JaffaCakes118
    /tmp/6e2e71eec8d4c018d70f33c15621aa35_JaffaCakes118
    1⤵
    • Modifies init.d
    • Reads system routing table
    • Write file to user bin folder
    • Checks CPU configuration
    • Reads system network configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1563
    • /bin/sh
      sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
      2⤵
        PID:1569
        • /usr/bin/ln
          ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
          3⤵
            PID:1570
        • /bin/sh
          sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
          2⤵
            PID:1571
            • /usr/bin/ln
              ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
              3⤵
                PID:1572
            • /bin/sh
              sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
              2⤵
                PID:1573
                • /usr/bin/ln
                  ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
                  3⤵
                    PID:1574
                • /bin/sh
                  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
                  2⤵
                    PID:1575
                    • /usr/bin/ln
                      ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
                      3⤵
                        PID:1576
                    • /bin/sh
                      sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
                      2⤵
                        PID:1577
                        • /usr/bin/ln
                          ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
                          3⤵
                            PID:1578
                        • /bin/sh
                          sh -c "mkdir -p /usr/bin/bsd-port"
                          2⤵
                            PID:1579
                            • /usr/bin/mkdir
                              mkdir -p /usr/bin/bsd-port
                              3⤵
                              • Reads runtime system information
                              PID:1580
                          • /bin/sh
                            sh -c "cp -f /tmp/6e2e71eec8d4c018d70f33c15621aa35_JaffaCakes118 /usr/bin/bsd-port/getty"
                            2⤵
                              PID:1581
                              • /usr/bin/cp
                                cp -f /tmp/6e2e71eec8d4c018d70f33c15621aa35_JaffaCakes118 /usr/bin/bsd-port/getty
                                3⤵
                                • Write file to user bin folder
                                • Reads runtime system information
                                PID:1582
                            • /bin/sh
                              sh -c /usr/bin/bsd-port/getty
                              2⤵
                                PID:1584
                                • /usr/bin/bsd-port/getty
                                  /usr/bin/bsd-port/getty
                                  3⤵
                                  • Executes dropped EXE
                                  • Modifies init.d
                                  • Write file to user bin folder
                                  • Checks CPU configuration
                                  • Reads system network configuration
                                  • Reads runtime system information
                                  PID:1585
                                  • /bin/sh
                                    sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
                                    4⤵
                                      PID:1605
                                      • /usr/bin/ln
                                        ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
                                        5⤵
                                          PID:1606
                                      • /bin/sh
                                        sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
                                        4⤵
                                          PID:1607
                                          • /usr/bin/ln
                                            ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
                                            5⤵
                                              PID:1608
                                          • /bin/sh
                                            sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
                                            4⤵
                                              PID:1609
                                              • /usr/bin/ln
                                                ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
                                                5⤵
                                                  PID:1610
                                              • /bin/sh
                                                sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
                                                4⤵
                                                  PID:1611
                                                  • /usr/bin/ln
                                                    ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
                                                    5⤵
                                                      PID:1612
                                                  • /bin/sh
                                                    sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
                                                    4⤵
                                                      PID:1613
                                                      • /usr/bin/ln
                                                        ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
                                                        5⤵
                                                          PID:1614
                                                      • /bin/sh
                                                        sh -c "mkdir -p /usr/bin/dpkgd"
                                                        4⤵
                                                          PID:1615
                                                          • /usr/bin/mkdir
                                                            mkdir -p /usr/bin/dpkgd
                                                            5⤵
                                                            • Reads runtime system information
                                                            PID:1616
                                                        • /bin/sh
                                                          sh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"
                                                          4⤵
                                                            PID:1617
                                                            • /usr/bin/cp
                                                              cp -f /bin/lsof /usr/bin/dpkgd/lsof
                                                              5⤵
                                                              • Write file to user bin folder
                                                              • Reads runtime system information
                                                              PID:1618
                                                          • /bin/sh
                                                            sh -c "mkdir -p /bin"
                                                            4⤵
                                                              PID:1619
                                                              • /usr/bin/mkdir
                                                                mkdir -p /bin
                                                                5⤵
                                                                • Reads runtime system information
                                                                PID:1620
                                                            • /bin/sh
                                                              sh -c "cp -f /usr/bin/bsd-port/getty /bin/lsof"
                                                              4⤵
                                                                PID:1621
                                                                • /usr/bin/cp
                                                                  cp -f /usr/bin/bsd-port/getty /bin/lsof
                                                                  5⤵
                                                                  • Writes file to system bin folder
                                                                  • Reads runtime system information
                                                                  PID:1622
                                                              • /bin/sh
                                                                sh -c "chmod 0755 /bin/lsof"
                                                                4⤵
                                                                  PID:1623
                                                                  • /usr/bin/chmod
                                                                    chmod 0755 /bin/lsof
                                                                    5⤵
                                                                      PID:1624
                                                                  • /bin/sh
                                                                    sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
                                                                    4⤵
                                                                      PID:1625
                                                                      • /usr/bin/cp
                                                                        cp -f /bin/ps /usr/bin/dpkgd/ps
                                                                        5⤵
                                                                        • Write file to user bin folder
                                                                        • Reads runtime system information
                                                                        PID:1626
                                                                    • /bin/sh
                                                                      sh -c "mkdir -p /bin"
                                                                      4⤵
                                                                        PID:1627
                                                                        • /usr/bin/mkdir
                                                                          mkdir -p /bin
                                                                          5⤵
                                                                          • Reads runtime system information
                                                                          PID:1628
                                                                      • /bin/sh
                                                                        sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
                                                                        4⤵
                                                                          PID:1629
                                                                          • /usr/bin/cp
                                                                            cp -f /usr/bin/bsd-port/getty /bin/ps
                                                                            5⤵
                                                                            • Writes file to system bin folder
                                                                            • Reads runtime system information
                                                                            PID:1630
                                                                        • /bin/sh
                                                                          sh -c "chmod 0755 /bin/ps"
                                                                          4⤵
                                                                            PID:1631
                                                                            • /usr/bin/chmod
                                                                              chmod 0755 /bin/ps
                                                                              5⤵
                                                                                PID:1632
                                                                            • /bin/sh
                                                                              sh -c "mkdir -p /usr/bin"
                                                                              4⤵
                                                                                PID:1633
                                                                                • /usr/bin/mkdir
                                                                                  mkdir -p /usr/bin
                                                                                  5⤵
                                                                                  • Reads runtime system information
                                                                                  PID:1634
                                                                              • /bin/sh
                                                                                sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
                                                                                4⤵
                                                                                  PID:1635
                                                                                  • /usr/bin/cp
                                                                                    cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
                                                                                    5⤵
                                                                                    • Write file to user bin folder
                                                                                    • Reads runtime system information
                                                                                    PID:1636
                                                                                • /bin/sh
                                                                                  sh -c "chmod 0755 /usr/bin/lsof"
                                                                                  4⤵
                                                                                    PID:1637
                                                                                    • /usr/bin/chmod
                                                                                      chmod 0755 /usr/bin/lsof
                                                                                      5⤵
                                                                                        PID:1638
                                                                                    • /bin/sh
                                                                                      sh -c "mkdir -p /usr/bin"
                                                                                      4⤵
                                                                                        PID:1640
                                                                                        • /usr/bin/mkdir
                                                                                          mkdir -p /usr/bin
                                                                                          5⤵
                                                                                          • Reads runtime system information
                                                                                          PID:1641
                                                                                      • /bin/sh
                                                                                        sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ps"
                                                                                        4⤵
                                                                                          PID:1643
                                                                                          • /usr/bin/cp
                                                                                            cp -f /usr/bin/bsd-port/getty /usr/bin/ps
                                                                                            5⤵
                                                                                            • Write file to user bin folder
                                                                                            • Reads runtime system information
                                                                                            PID:1644
                                                                                        • /bin/sh
                                                                                          sh -c "chmod 0755 /usr/bin/ps"
                                                                                          4⤵
                                                                                            PID:1645
                                                                                            • /usr/bin/chmod
                                                                                              chmod 0755 /usr/bin/ps
                                                                                              5⤵
                                                                                                PID:1646
                                                                                            • /bin/sh
                                                                                              sh -c "insmod /usr/lib/xpacket.ko"
                                                                                              4⤵
                                                                                                PID:1647
                                                                                                • /usr/sbin/insmod
                                                                                                  insmod /usr/lib/xpacket.ko
                                                                                                  5⤵
                                                                                                  • Reads runtime system information
                                                                                                  PID:1648
                                                                                          • /bin/sh
                                                                                            sh -c "mkdir -p /usr/bin"
                                                                                            2⤵
                                                                                              PID:1587
                                                                                              • /usr/bin/mkdir
                                                                                                mkdir -p /usr/bin
                                                                                                3⤵
                                                                                                • Reads runtime system information
                                                                                                PID:1588
                                                                                            • /bin/sh
                                                                                              sh -c "cp -f /tmp/6e2e71eec8d4c018d70f33c15621aa35_JaffaCakes118 /usr/bin/.sshd"
                                                                                              2⤵
                                                                                                PID:1589
                                                                                                • /usr/bin/cp
                                                                                                  cp -f /tmp/6e2e71eec8d4c018d70f33c15621aa35_JaffaCakes118 /usr/bin/.sshd
                                                                                                  3⤵
                                                                                                  • Write file to user bin folder
                                                                                                  • Reads runtime system information
                                                                                                  PID:1590
                                                                                              • /bin/sh
                                                                                                sh -c /usr/bin/.sshd
                                                                                                2⤵
                                                                                                  PID:1592
                                                                                                  • /usr/bin/.sshd
                                                                                                    /usr/bin/.sshd
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Reads runtime system information
                                                                                                    • Writes file to tmp directory
                                                                                                    PID:1593
                                                                                                • /bin/sh
                                                                                                  sh -c "insmod /usr/lib/xpacket.ko"
                                                                                                  2⤵
                                                                                                    PID:1595
                                                                                                    • /usr/sbin/insmod
                                                                                                      insmod /usr/lib/xpacket.ko
                                                                                                      3⤵
                                                                                                      • Reads runtime system information
                                                                                                      PID:1596

                                                                                                Network

                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • /etc/init.d/DbSecuritySpt

                                                                                                  Filesize

                                                                                                  64B

                                                                                                  MD5

                                                                                                  418f423ba0e741e9dcd7206f3e60e90b

                                                                                                  SHA1

                                                                                                  ce1e31ca39066d49013348eff7c2c992472a8b69

                                                                                                  SHA256

                                                                                                  16a7e222f7bbdc49beea057facc3d68c93ade2ef14a7665d5abbac13d19e8a8a

                                                                                                  SHA512

                                                                                                  f7c1b09f9c8de6463d31d5736a44a04f7988e4ef3cd269aa52e95b2e9ec79e5a54d18c29880762ef34fc8b9adb6f2495de53a2097bb04a05ce1458de610a235c

                                                                                                • /etc/init.d/selinux

                                                                                                  Filesize

                                                                                                  36B

                                                                                                  MD5

                                                                                                  993cc15058142d96c3daf7852c3d5ee8

                                                                                                  SHA1

                                                                                                  0950b8b391b04dd3895ea33cd3141543ebd2525d

                                                                                                  SHA256

                                                                                                  8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

                                                                                                  SHA512

                                                                                                  0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

                                                                                                • /tmp/conf.n

                                                                                                  Filesize

                                                                                                  69B

                                                                                                  MD5

                                                                                                  227856889c50184308123071d54e9a8c

                                                                                                  SHA1

                                                                                                  ef1f44f44c1b9cda768cedbf085d984fac1094c0

                                                                                                  SHA256

                                                                                                  842f3c609faab1be3d68bf9e9e6fd594be0057450988cc00274c0d8ed5b14345

                                                                                                  SHA512

                                                                                                  edc405aa41c9bb428455d737bf4e57b3a735a80aafd935b7cdbae0da2f3dc5126e3eb8396b2fe22e1f1680550e9c23830a7214c9ab98e2dde5b9c268d18c9243

                                                                                                • /tmp/gates.lock

                                                                                                  Filesize

                                                                                                  4B

                                                                                                  MD5

                                                                                                  facf9f743b083008a894eee7baa16469

                                                                                                  SHA1

                                                                                                  fe286d02f80118de47f2226c2fce9f7be0bc04f0

                                                                                                  SHA256

                                                                                                  2163909115c0f6f1e638bd2c2279387cbe37cc327150a7b5cddfde3d1cd4ef0e

                                                                                                  SHA512

                                                                                                  7bd3d1d347d68f23d612a3ec7a1d2f4094874162441bae20122876ea980bbb76a3c46d5d2e393975ea0659fb2b58046a311d7660f226482a57a74e9ffd9b0f36

                                                                                                • /tmp/moni.lock

                                                                                                  Filesize

                                                                                                  4B

                                                                                                  MD5

                                                                                                  0ebcc77dc72360d0eb8e9504c78d38bd

                                                                                                  SHA1

                                                                                                  8b583aa0ac7f15508192f2ea1c56b9a07eb48e38

                                                                                                  SHA256

                                                                                                  8698616a6419549cd9c035d5e250c81c6cefff11ff31c9602bf2ff5aa3e06b7f

                                                                                                  SHA512

                                                                                                  18bc49d42d4b488f1264cf1f0fb6f914aa29d320e8721f75da80e9324a63c027670f82f6a0549837caac67f83e83dd67480305c079d65a380b54ff013ca11727

                                                                                                • /tmp/notify.file

                                                                                                  Filesize

                                                                                                  51B

                                                                                                  MD5

                                                                                                  8fca0c1cd41a9c413d2bfaa32c24299f

                                                                                                  SHA1

                                                                                                  e6b776d05231838ddf49c288881f02f9f12a6875

                                                                                                  SHA256

                                                                                                  407bb1250c37d9cd76c0dd1d1e666e27bff48255c840488073753cc69b6d6250

                                                                                                  SHA512

                                                                                                  11246ab004981e1cbd7476bfb010187689fa317cf75ddb9487f3b32c3a206a303bdcad621e16d4041c1700330bfebaad636ddad428dcf91da30c9dbb289fff4a

                                                                                                • /usr/bin/bsd-port/getty

                                                                                                  Filesize

                                                                                                  1.5MB

                                                                                                  MD5

                                                                                                  6e2e71eec8d4c018d70f33c15621aa35

                                                                                                  SHA1

                                                                                                  c83935da847a5eeff1152565cdb79e1129cf4e00

                                                                                                  SHA256

                                                                                                  98811afe3b43cebb55cf7e70463622dc66e020edf5b0d39d198438abf7740814

                                                                                                  SHA512

                                                                                                  664defc7f27f4cb9445b24c298f35f559c089ea5847be62db9bfc7384b970bd620235f7a2f81d6ad5d7e41c0f1bca4b4f358fdd98e7764e2d96aa91106490c31

                                                                                                • /usr/bin/dpkgd/lsof

                                                                                                  Filesize

                                                                                                  163KB

                                                                                                  MD5

                                                                                                  ab57b66cc531ae0f996963223e632b60

                                                                                                  SHA1

                                                                                                  bf7e5becd33f21c2539f5a75ffa0ab61c49c8795

                                                                                                  SHA256

                                                                                                  2484863a7bfda7f97b90bfd5dfceed4ec9f27dd51f9c5158c8daabbf4309b1df

                                                                                                  SHA512

                                                                                                  908acef13f3c1d80b7169ec3b16bb67006013453348fff75550bc3c6c2137e798b21d7990edbd5be63d756d9c41b06160aebf38aa80547e4bafa3a62596057f6

                                                                                                • /usr/bin/dpkgd/ps

                                                                                                  Filesize

                                                                                                  138KB

                                                                                                  MD5

                                                                                                  8146139c2ad7e550b1d1f49480997446

                                                                                                  SHA1

                                                                                                  074db8890c3227bd8a588417f5b9bde637bcf3af

                                                                                                  SHA256

                                                                                                  207df9d438f75185ab3af2ab1173d104831a6631c28ef40d38b2ab43de27b40f

                                                                                                  SHA512

                                                                                                  b6d71d537f593b9af833e6f798e412e95fc486a313414ed8cca9639f61be7ac9dca700e9f861c0d07c7f65b3783127a67f829f422472cad8938ba01d397ab9de