Overview

overview

10

Static

static

10

99dd485841...kes118

ubuntu-18.04-amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    99dd48584152704db970a7b536c47bd5_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240815-l9mkfaxgme

  • MD5

    99dd48584152704db970a7b536c47bd5

  • SHA1

    eac36532779460580cd80e8f3d22e324bae71494

  • SHA256

    544d2f9e21eb2892b5d2bd0135cb2b7a7e9d35983eed1ecbf45e71e89f4fb0a7

  • SHA512

    34bcb7f4bbc1cb74f0ef6f6d8c04c12987d0d5756cf148cb79f7448891fc46c37d08a816ebb9e4fda3dc62befafc42aadd863956699cd2c82a35279e0bd94025

  • SSDEEP

    24576:e845rGHu6gVJKG75oFpA0VWeX4/2y1q2rJp0:745vRVJKGtSA0VWeo+u9p0

Score
10/10
mrblackantivmbotnetlinuxpersistencetrojan

Malware Config

Targets

    • Target

      99dd48584152704db970a7b536c47bd5_JaffaCakes118

    • Size

      1.2MB

    • MD5

      99dd48584152704db970a7b536c47bd5

    • SHA1

      eac36532779460580cd80e8f3d22e324bae71494

    • SHA256

      544d2f9e21eb2892b5d2bd0135cb2b7a7e9d35983eed1ecbf45e71e89f4fb0a7

    • SHA512

      34bcb7f4bbc1cb74f0ef6f6d8c04c12987d0d5756cf148cb79f7448891fc46c37d08a816ebb9e4fda3dc62befafc42aadd863956699cd2c82a35279e0bd94025

    • SSDEEP

      24576:e845rGHu6gVJKG75oFpA0VWeX4/2y1q2rJp0:745vRVJKGtSA0VWeo+u9p0

    Score
    10/10
    mrblackantivmbotnetpersistencetrojan

    • MrBlack Trojan

      IoT botnet which infects routers to be used for DDoS attacks.

      trojanbotnetmrblack

    • MrBlack trojan

    • Executes dropped EXE

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Write file to user bin folder

    • Writes file to system bin folder

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks