mrblack | 8cf917f730b3432a1d238a44943f520142f52ac07494460aec3008a7e954dfbb

Analysis

max time kernel
149s
max time network
145s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240729-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
16-08-2024 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118
Size

1.1MB
MD5

9df1353dbf715d5c4f580549d520fc5a
SHA1

55df8257d85a8db943d20e6753b02e53b557b9e8
SHA256

8cf917f730b3432a1d238a44943f520142f52ac07494460aec3008a7e954dfbb
SHA512

7ed70bb6e6f04527ea73f50754356d57656209047eaae4c3f5290bb81c0a0654d1feb09f1971704eed41b074bb214c10d2407094d0e266256d70f6e418b39e15
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfaGI+gIGYuuCol7r:4vREKfPqVE5jKsfaGRHGVo7r

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/getty	1525	getty
/etc/ssh/sshpa	1533	sshpa

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/init.d/selinux	getty
File opened for modification	/etc/init.d/DbSecuritySpt	9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/route	9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118

Write file to user bin folder 1 TTPs 7 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/udevd.lock	9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	getty

Writes file to system bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/ps	cp

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118
File opened for reading	/proc/cpuinfo	getty

Reads system network configuration 1 TTPs 4 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/dev	9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118
File opened for reading	/proc/net/dev	getty
File opened for reading	/proc/net/route	9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118
File opened for reading	/proc/net/arp	9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118

Reads runtime system information 17 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/meminfo	getty
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo	9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118
File opened for reading	/proc/stat	getty
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/notify.file	9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118
File opened for modification	/tmp/moni.lock	sshpa
File opened for modification	/tmp/notify.file	sshpa
File opened for modification	/tmp/conf.n	9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118
File opened for modification	/tmp/gates.lock	sshpa
File opened for modification	/tmp/moni.lock	9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118
File opened for modification	/tmp/bill.lock	9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118
File opened for modification	/tmp/gates.lock	9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118

/tmp/9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118
/tmp/9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118
1⤵
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1504
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
  2⤵
  PID:1509
- - /bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
    3⤵
    PID:1510
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
  2⤵
  PID:1511
- - /bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
    3⤵
    PID:1512
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
  2⤵
  PID:1513
- - /bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
    3⤵
    PID:1514
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
  2⤵
  PID:1515
- - /bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
    3⤵
    PID:1516
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
  2⤵
  PID:1517
- - /bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
    3⤵
    PID:1518
- /bin/sh
  sh -c "mkdir -p /usr/bin/bsd-port"
  2⤵
  PID:1519
- - /bin/mkdir
    mkdir -p /usr/bin/bsd-port
    3⤵
    - Reads runtime system information
    PID:1520
- /bin/sh
  sh -c "cp -f /tmp/9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118 /usr/bin/bsd-port/getty"
  2⤵
  PID:1521
- - /bin/cp
    cp -f /tmp/9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118 /usr/bin/bsd-port/getty
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1522
- /bin/sh
  sh -c /usr/bin/bsd-port/getty
  2⤵
  PID:1524
- - /usr/bin/bsd-port/getty
    /usr/bin/bsd-port/getty
    3⤵
    - Executes dropped EXE
    - Modifies init.d
    - Write file to user bin folder
    - Checks CPU configuration
    - Reads system network configuration
    - Reads runtime system information
    PID:1525
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
      4⤵
      PID:1541
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
        5⤵
        
        PID:1542
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
      4⤵
      PID:1543
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
        5⤵
        
        PID:1544
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
      4⤵
      PID:1545
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
        5⤵
        
        PID:1546
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
      4⤵
      PID:1547
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
        5⤵
        
        PID:1548
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
      4⤵
      PID:1549
    - - /bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
        5⤵
        
        PID:1550
  - - /bin/sh
      sh -c "mkdir -p /usr/bin/dpkgd"
      4⤵
      PID:1551
    - - /bin/mkdir
        
        mkdir -p /usr/bin/dpkgd
        5⤵
        Reads runtime system information
        
        PID:1552
  - - /bin/sh
      sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
      4⤵
      PID:1553
    - - /bin/cp
        
        cp -f /bin/ps /usr/bin/dpkgd/ps
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1554
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1555
    - - /bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1557
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
      4⤵
      PID:1558
    - - /bin/cp
        
        cp -f /usr/bin/bsd-port/getty /bin/ps
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1559
  - - /bin/sh
      sh -c "chmod 0755 /bin/ps"
      4⤵
      PID:1560
    - - /bin/chmod
        
        chmod 0755 /bin/ps
        5⤵
        
        PID:1561
  - - /bin/sh
      sh -c "cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof"
      4⤵
      PID:1562
    - - /bin/cp
        
        cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1563
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1565
    - - /bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1566
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
      4⤵
      PID:1567
    - - /bin/cp
        
        cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1568
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/lsof"
      4⤵
      PID:1569
    - - /bin/chmod
        
        chmod 0755 /usr/bin/lsof
        5⤵
        
        PID:1570
  - - /bin/sh
      sh -c "insmod /usr/lib/xpacket.ko"
      4⤵
      PID:1571
    - - /sbin/insmod
        
        insmod /usr/lib/xpacket.ko
        5⤵
        Reads runtime system information
        
        PID:1572
- /bin/sh
  sh -c "mkdir -p /etc/ssh"
  2⤵
  PID:1527
- - /bin/mkdir
    mkdir -p /etc/ssh
    3⤵
    - Reads runtime system information
    PID:1528
- /bin/sh
  sh -c "cp -f /tmp/9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118 /etc/ssh/sshpa"
  2⤵
  PID:1529
- - /bin/cp
    cp -f /tmp/9df1353dbf715d5c4f580549d520fc5a_JaffaCakes118 /etc/ssh/sshpa
    3⤵
    - Reads runtime system information
    PID:1530
- /bin/sh
  sh -c /etc/ssh/sshpa
  2⤵
  PID:1532
- - /etc/ssh/sshpa
    /etc/ssh/sshpa
    3⤵
    - Executes dropped EXE
    - Writes file to tmp directory
    PID:1533
- /bin/sh
  sh -c "insmod /usr/lib/xpacket.ko"
  2⤵
  PID:1535
- - /sbin/insmod
    insmod /usr/lib/xpacket.ko
    3⤵
    - Reads runtime system information
    PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
64B

MD5
6189d5e2b0ddc588f4a512401ede0e1f

SHA1
d7f8e30377814a662fd8a67ce6110e60abf3b49a

SHA256
048dc4a48187f1c129cd92dccde28a4b740e8abc21d059278fca17ce5fd3db99

SHA512
da1de9a4445c4dc12c96cc479467e2bb1dbbd42ab5535ad09f2d39c12eb87460dbc73f4f267d1c7740770bea6c9cb9743998942a88b24fb9bfb53d40ae5320af

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/gates.lock

Filesize
4B

MD5
0c9ebb2ded806d7ffda75cd0b95eb70c

SHA1
9492dfa1e0a89d7e4fab574112c048faf6ef87b3

SHA256
755917ecbc61091ffa6b605d7f82bdaa4e4cbdc309124807b0fb63228d0696df

SHA512
fd1f0dd6c5175ab1fe3be9a1ed4a5f0fabe02a799f5de59b303b44dec219f5b43434aed40b8d9674dd55435ae5b9eec6aa7bc7db982b7d526ab57128511340ea

Download Submit
/tmp/moni.lock

Filesize
4B

MD5
d63fbf8c3173730f82b150c5ef38b8ff

SHA1
1d23c8edf135106a57d7f1694d9c2c7eb67cc326

SHA256
13be5b896be039957e7996f606c8513fa2d9061132bdcabdbee5a362dd9fd8ff

SHA512
275c9875be2b60cc2d67678f6c08b9bfb4f21f8f087eaa942aad8d808f2141a9d1b376e1825ab764f8eda46cc7f6a86490d8475ca8446a6ef519c71784fdc11a

Download Submit
/tmp/notify.file

Filesize
51B

MD5
462858f7c22a1f17bc45084df5d1e251

SHA1
a4fb0cee1046f8f5a979a6c317acfe9add47e49f

SHA256
0c30d48ac045c21b4612369af76951fe82770bc4bf645e10cf71ffadeb2e9468

SHA512
c2ffb20e474d72769b790d151bc9001a71a33b4215303c6db40bc6d404af8ad3c8842e6abf1c64d5736244a21dbf17d74aaddb807e881e245a95bd10d0569a18

Download Submit
/usr/bin/bsd-port/getty

Filesize
1.1MB

MD5
9df1353dbf715d5c4f580549d520fc5a

SHA1
55df8257d85a8db943d20e6753b02e53b557b9e8

SHA256
8cf917f730b3432a1d238a44943f520142f52ac07494460aec3008a7e954dfbb

SHA512
7ed70bb6e6f04527ea73f50754356d57656209047eaae4c3f5290bb81c0a0654d1feb09f1971704eed41b074bb214c10d2407094d0e266256d70f6e418b39e15

Download Submit
/usr/bin/dpkgd/lsof

Filesize
159KB

MD5
e093dc78225e2a0a25e3b137c1c1e442

SHA1
c29497cfaae729eb576875e4fdfa400640ab16be

SHA256
1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e

SHA512
fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0

Download Submit
/usr/bin/dpkgd/ps

Filesize
130KB

MD5
558edc26f8a38fa9788220b9af8a73e7

SHA1
3024d44e580e9c67f32f6c585d50e2a6cc9a7cac

SHA256
b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5

SHA512
edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads