mrblack | 3a5b4c54ae3d05814be32f0a2d782728ee089fe329c73b12d0d2d30306683e8d

Analysis

max time kernel
146s
max time network
146s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
10-08-2024 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88309a2bb97224015d0f6228f3018d26_JaffaCakes118
Size

1.1MB
MD5

88309a2bb97224015d0f6228f3018d26
SHA1

f7a0ccba8f24231cb3a20eb0421827d38d7d1cd6
SHA256

3a5b4c54ae3d05814be32f0a2d782728ee089fe329c73b12d0d2d30306683e8d
SHA512

20e3740c48e83a0f380aea69072b2b2222b1eea6ba2189b4ef34d6330e0fca8102b13a7e0c06423b5555b037f174a8719871106541e060563b86c5acbb124255
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfaFI+gIGYuuCol7r:4vREKfPqVE5jKsfaFRHGVo7r

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

resource	yara_rule
behavioral1/files/fstream-5.dat	family_mrblack

Executes dropped EXE 5 IoCs

ioc	pid	Process
/usr/bin/pythno	1584	pythno
/tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118	1610	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
/usr/bin/pythno	1618	pythno
/tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118	1650	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
/usr/bin/pythno	1658	pythno

Modifies init.d 1 TTPs 3 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/init.d/VsystemsshMdt	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for modification	/etc/init.d/VsystemsshMdt	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for modification	/etc/init.d/VsystemsshMdt	88309a2bb97224015d0f6228f3018d26_JaffaCakes118

Write file to user bin folder 1 TTPs 3 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/pythno	cp
File opened for modification	/usr/bin/pythno	cp
File opened for modification	/usr/bin/pythno	cp

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for reading	/proc/cpuinfo	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for reading	/proc/cpuinfo	88309a2bb97224015d0f6228f3018d26_JaffaCakes118

Reads system network configuration 1 TTPs 3 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/dev	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for reading	/proc/net/dev	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for reading	/proc/net/dev	88309a2bb97224015d0f6228f3018d26_JaffaCakes118

Reads runtime system information 25 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/meminfo	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/version	pythno
File opened for reading	/proc/sys/kernel/version	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/stat	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/version	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for reading	/proc/sys/kernel/version	pythno
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/stat	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for reading	/proc/meminfo	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for reading	/proc/meminfo	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/version	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for reading	/proc/sys/kernel/version	pythno
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 20 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118	cp
File opened for modification	/tmp/sgt.conf	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for modification	/tmp/notify.file	pythno
File opened for modification	/tmp/http.log	pythno
File opened for modification	/tmp/http.log	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for modification	/tmp/http.log	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for modification	/tmp/notify.file	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for modification	/tmp/notify.file	pythno
File opened for modification	/tmp/httf.conf	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for modification	/tmp/notify.file	pythno
File opened for modification	/tmp/notify.file	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for modification	/tmp/notify.file	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for modification	/tmp/http.log	pythno
File opened for modification	/tmp/http.log	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for modification	/tmp/httf.conf	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for modification	/tmp/http.log	pythno
File opened for modification	/tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118	cp
File opened for modification	/tmp/httf.conf	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for modification	/tmp/sgt.conf	88309a2bb97224015d0f6228f3018d26_JaffaCakes118
File opened for modification	/tmp/sgt.conf	88309a2bb97224015d0f6228f3018d26_JaffaCakes118

/tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118
/tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118
1⤵
- Modifies init.d
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1562
- /bin/sh
  sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt"
  2⤵
  PID:1568
- - /usr/bin/ln
    ln -s /etc/init.d/VsystemsshMdt /etc/rc1.d/S97VsystemsshMdt
    3⤵
    PID:1569
- /bin/sh
  sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt"
  2⤵
  PID:1570
- - /usr/bin/ln
    ln -s /etc/init.d/VsystemsshMdt /etc/rc2.d/S97VsystemsshMdt
    3⤵
    PID:1571
- /bin/sh
  sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt"
  2⤵
  PID:1572
- - /usr/bin/ln
    ln -s /etc/init.d/VsystemsshMdt /etc/rc3.d/S97VsystemsshMdt
    3⤵
    PID:1573
- /bin/sh
  sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt"
  2⤵
  PID:1574
- - /usr/bin/ln
    ln -s /etc/init.d/VsystemsshMdt /etc/rc4.d/S97VsystemsshMdt
    3⤵
    PID:1575
- /bin/sh
  sh -c "ln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt"
  2⤵
  PID:1576
- - /usr/bin/ln
    ln -s /etc/init.d/VsystemsshMdt /etc/rc5.d/S97VsystemsshMdt
    3⤵
    PID:1577
- /bin/sh
  sh -c "mkdir -p /usr/bin"
  2⤵
  PID:1578
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:1579
- /bin/sh
  sh -c "cp -f /tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118 /usr/bin/pythno"
  2⤵
  PID:1580
- - /usr/bin/cp
    cp -f /tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118 /usr/bin/pythno
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1581
- /bin/sh
  sh -c /usr/bin/pythno
  2⤵
  PID:1583
- - /usr/bin/pythno
    /usr/bin/pythno
    3⤵
    - Executes dropped EXE
    - Reads runtime system information
    - Writes file to tmp directory
    PID:1584
  - - /bin/sh
      sh -c "mkdir -p /tmp"
      4⤵
      PID:1604
    - - /usr/bin/mkdir
        
        mkdir -p /tmp
        5⤵
        Reads runtime system information
        
        PID:1605
  - - /bin/sh
      sh -c "cp -f /usr/bin/pythno /tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118"
      4⤵
      PID:1606
    - - /usr/bin/cp
        
        cp -f /usr/bin/pythno /tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118
        5⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1607
  - - /bin/sh
      sh -c /tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118
      4⤵
      PID:1609
    - - /tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118
        
        /tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118
        5⤵
        Executes dropped EXE
        Modifies init.d
        Checks CPU configuration
        Reads system network configuration
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1610
      - /bin/sh
        
        sh -c "mkdir -p /usr/bin"
        6⤵
        
        PID:1612
        
        /usr/bin/mkdir
        
        mkdir -p /usr/bin
        7⤵
        Reads runtime system information
        
        PID:1613
      - /bin/sh
        
        sh -c "cp -f /tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118 /usr/bin/pythno"
        6⤵
        
        PID:1614
        
        /usr/bin/cp
        
        cp -f /tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118 /usr/bin/pythno
        7⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1615
      - /bin/sh
        
        sh -c /usr/bin/pythno
        6⤵
        
        PID:1617
        
        /usr/bin/pythno
        
        /usr/bin/pythno
        7⤵
        Executes dropped EXE
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1618
        
        /bin/sh
        
        sh -c "mkdir -p /tmp"
        8⤵
        
        PID:1644
        
        /usr/bin/mkdir
        
        mkdir -p /tmp
        9⤵
        Reads runtime system information
        
        PID:1645
        
        /bin/sh
        
        sh -c "cp -f /usr/bin/pythno /tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118"
        8⤵
        
        PID:1646
        
        /usr/bin/cp
        
        cp -f /usr/bin/pythno /tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118
        9⤵
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1647
        
        /bin/sh
        
        sh -c /tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118
        8⤵
        
        PID:1649
        
        /tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118
        
        /tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118
        9⤵
        Executes dropped EXE
        Modifies init.d
        Checks CPU configuration
        Reads system network configuration
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1650
        
        /bin/sh
        
        sh -c "mkdir -p /usr/bin"
        10⤵
        
        PID:1652
        
        /usr/bin/mkdir
        
        mkdir -p /usr/bin
        11⤵
        Reads runtime system information
        
        PID:1653
        
        /bin/sh
        
        sh -c "cp -f /tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118 /usr/bin/pythno"
        10⤵
        
        PID:1654
        
        /usr/bin/cp
        
        cp -f /tmp/88309a2bb97224015d0f6228f3018d26_JaffaCakes118 /usr/bin/pythno
        11⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1655
        
        /bin/sh
        
        sh -c /usr/bin/pythno
        10⤵
        
        PID:1657
        
        /usr/bin/pythno
        
        /usr/bin/pythno
        11⤵
        Executes dropped EXE
        Reads runtime system information
        Writes file to tmp directory
        
        PID:1658
        
        /bin/sh
        
        sh -c "insmod /usr/lib/xpacket.ko"
        10⤵
        
        PID:1660
        
        /usr/sbin/insmod
        
        insmod /usr/lib/xpacket.ko
        11⤵
        Reads runtime system information
        
        PID:1661
      - /bin/sh
        
        sh -c "insmod /usr/lib/xpacket.ko"
        6⤵
        
        PID:1620
        
        /usr/sbin/insmod
        
        insmod /usr/lib/xpacket.ko
        7⤵
        Reads runtime system information
        
        PID:1621
- /bin/sh
  sh -c "insmod /usr/lib/xpacket.ko"
  2⤵
  PID:1586
- - /usr/sbin/insmod
    insmod /usr/lib/xpacket.ko
    3⤵
    - Reads runtime system information
    PID:1587

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/VsystemsshMdt

Filesize
64B

MD5
28fb5d654fe5a29ca24d2dbaabd6fe99

SHA1
1c14592ee6a7908e88e7a9e0fe46d2b0b94ec975

SHA256
9b7bf7fa67c2fb6d1f09dd6cd1f6778008fbed76caa9a2e94f81df49dea27249

SHA512
eb333ae7c0f45abe74188b71cf02395ef7f0b905036e0c669db2603be67e99814aeede97ae2c0535ae3f112ccffaabe411aaf5dc2e33c6e933eedb8a1f06141e

Download Submit
/tmp/http.log

Filesize
4B

MD5
d1dc3a8270a6f9394f88847d7f0050cf

SHA1
4144a50012a273c9a22b8e634d0ef46fa90835e4

SHA256
48af26beb80f0b14f33670336b3deb3b55b7d8f7eb33709596c6174394661034

SHA512
b53a5a9b2a570422785633952c81ba21a2d14323314576ae606c832865ff22e89dd2639c7cb3a836269d6aecebe56fc67a3867295c3af3c20cd003b2cdb5fc59

Download Submit
/tmp/http.log

Filesize
4B

MD5
e1696007be4eefb81b1a1d39ce48681b

SHA1
3a0a15b1acfdff78e92c39b5d32d3650e5a284d8

SHA256
aed8be046f04a89cfa707bb5c1c52e6f374393507edfb090fbd409810b325bee

SHA512
8a6115e73f2085884dd6a50d910afdc8114a0b403db58b1c5e9fbe64b15133702f0168f590b86f8a09f1da2608b74e93a3d64b61f8b2f2f08deefebfa8dc954a

Download Submit
/tmp/http.log

Filesize
4B

MD5
228499b55310264a8ea0e27b6e7c6ab6

SHA1
178116e63a31913ab6da9ab6d92cb510dea7964c

SHA256
9c8dd327d0f259b6facd68100f664c432101f783d31ac9b78b6e9eaf9fa786b8

SHA512
2efeadcee6aa3eb7e370b8e05d12c7269d92180eda2f8665b8663888ed85a4caecf6ed31e5a070de68f43a76b7a24f4cb0b2e6f3f9c017df05f77e6a6bd93c0f

Download Submit
/tmp/notify.file

Filesize
51B

MD5
aac2f9a0275356cff8c235e0b0799cfd

SHA1
bd4df783f7e64d15939d48601ce87f27044f34ad

SHA256
74023a0e5d04f9bb7423c965c37e6131bcb2f5d01b2cdf9e43c4c097598ad257

SHA512
611b876575fb0d78d45571cef96c4f64ac22e98f5b74ff83af8d2ae220b812068a1cdee62ea19a8a9c3af180d168a213c3b7776d7a3df4ccca6daae79804d62d

Download Submit
/tmp/sgt.conf

Filesize
4B

MD5
be3e9d3f7d70537357c67bb3f4086846

SHA1
480619ef8900e4598b0c8148ffe0192c0b284f2d

SHA256
2b1545d9e4c5685925e30a7ad1a0a47327afaeeac7f5e53cab34468198e782af

SHA512
3b4b3b4beccbc2d1ac8cbf06403cfd835743b94aa0b587f93c6bae695a818464dcd5a1895e54345a8dd8b7974618025682d66b42879c4c276ef757e5fbc92a0b

Download Submit
/tmp/sgt.conf

Filesize
4B

MD5
4d6e4749289c4ec58c0063a90deb3964

SHA1
a0e3eab3c80118379cb2e1d7b163f82494430e03

SHA256
e830a0d7d5f303724e6404c8f9797580b6e77e4bdab70b8e163967925b69e6d0

SHA512
c0a696afb1940c302622b6ba6ec2913c19903291626073ed3233a16000d45bb61ec7c676c42c1ae0e0b32126d9f72e938a80e665a68ad3fbfa0e606c352276ed

Download Submit
/tmp/sgt.conf

Filesize
4B

MD5
7a6a74cbe87bc60030a4bd041dd47b78

SHA1
fc1d7734529e84f8deb77cd00aa8cd80fb71e5e4

SHA256
68722dedde84631c45b4aade9365a91aa6fd11c5766e66191ffbf07361204a4c

SHA512
eb271a6f30675bb2296d4c4ebcc69ce031c68f8c21d9303019a2a54cd6481818dca34b303d9431c822703ad918d613ddd1910da74dfd0696eec2619175923b31

Download Submit
/usr/bin/pythno

Filesize
1.1MB

MD5
88309a2bb97224015d0f6228f3018d26

SHA1
f7a0ccba8f24231cb3a20eb0421827d38d7d1cd6

SHA256
3a5b4c54ae3d05814be32f0a2d782728ee089fe329c73b12d0d2d30306683e8d

SHA512
20e3740c48e83a0f380aea69072b2b2222b1eea6ba2189b4ef34d6330e0fca8102b13a7e0c06423b5555b037f174a8719871106541e060563b86c5acbb124255

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads