mrblack | 63ef4ac602d7419817cbc4c645d96bdd1d326f1f33d2ff5425a16695792139b1

Analysis

max time kernel
149s
max time network
149s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
23-08-2024 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118
Size

1.1MB
MD5

bbb3b0d220b420d93bc8cb84a8796b99
SHA1

3f4fa3db400705580431141c5f5180b4a12b0b54
SHA256

63ef4ac602d7419817cbc4c645d96bdd1d326f1f33d2ff5425a16695792139b1
SHA512

1d1f11c5184bcc54467280e9debea7c4e720931ba335a87b5a3f80a74aa5df3d394e75f6510be60fa87726dd502eb3ddceb3f8f99721eae80cd50ac1f5b8c7da
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfa1I+gIGYuuCol7r:4vREKfPqVE5jKsfa1RHGVo7r

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack

Executes dropped EXE 2 IoCs

ioc	pid	Process
/usr/bin/bsd-port/agent	1586	agent
/usr/bin/acpid	1594	acpid

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

description	ioc	Process
File opened for modification	/etc/init.d/DbSecurityMdt	bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118
File opened for modification	/etc/init.d/selinux	agent

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/route	agent

Write file to user bin folder 1 TTPs 10 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/bsd-port/conf.n	agent
File opened for modification	/usr/bin/bsd-port/agent.conf	bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/udevd.conf	bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/agent	cp
File opened for modification	/usr/bin/acpid	cp
File opened for modification	/usr/bin/bsd-port/agent.conf	agent
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/ps	cp

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
File opened for modification	/bin/ps	cp
File opened for modification	/bin/lsof	cp

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118
File opened for reading	/proc/cpuinfo	agent

Reads system network configuration 1 TTPs 4 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

description	ioc	Process
File opened for reading	/proc/net/route	agent
File opened for reading	/proc/net/arp	agent
File opened for reading	/proc/net/dev	bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118
File opened for reading	/proc/net/dev	agent

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/sys/kernel/version	bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo	bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118
File opened for reading	/proc/stat	agent
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/version	acpid
File opened for reading	/proc/stat	bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/version	agent
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo	agent

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/moni.note	acpid
File opened for modification	/tmp/notify.file	acpid
File opened for modification	/tmp/gates.note	acpid
File opened for modification	/tmp/moni.note	bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118
File opened for modification	/tmp/bill.note	bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118
File opened for modification	/tmp/gates.note	bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118
File opened for modification	/tmp/notify.file	bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118

/tmp/bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118
/tmp/bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118
1⤵
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1564
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc1.d/S97DbSecurityMdt"
  2⤵
  PID:1570
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecurityMdt /etc/rc1.d/S97DbSecurityMdt
    3⤵
    PID:1571
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc2.d/S97DbSecurityMdt"
  2⤵
  PID:1572
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecurityMdt /etc/rc2.d/S97DbSecurityMdt
    3⤵
    PID:1573
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc3.d/S97DbSecurityMdt"
  2⤵
  PID:1574
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecurityMdt /etc/rc3.d/S97DbSecurityMdt
    3⤵
    PID:1575
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc4.d/S97DbSecurityMdt"
  2⤵
  PID:1576
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecurityMdt /etc/rc4.d/S97DbSecurityMdt
    3⤵
    PID:1577
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc5.d/S97DbSecurityMdt"
  2⤵
  PID:1578
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecurityMdt /etc/rc5.d/S97DbSecurityMdt
    3⤵
    PID:1579
- /bin/sh
  sh -c "mkdir -p /usr/bin/bsd-port"
  2⤵
  PID:1580
- - /usr/bin/mkdir
    mkdir -p /usr/bin/bsd-port
    3⤵
    - Reads runtime system information
    PID:1581
- /bin/sh
  sh -c "cp -f /tmp/bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118 /usr/bin/bsd-port/agent"
  2⤵
  PID:1582
- - /usr/bin/cp
    cp -f /tmp/bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118 /usr/bin/bsd-port/agent
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1583
- /bin/sh
  sh -c /usr/bin/bsd-port/agent
  2⤵
  PID:1585
- - /usr/bin/bsd-port/agent
    /usr/bin/bsd-port/agent
    3⤵
    - Executes dropped EXE
    - Modifies init.d
    - Reads system routing table
    - Write file to user bin folder
    - Checks CPU configuration
    - Reads system network configuration
    - Reads runtime system information
    PID:1586
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
      4⤵
      PID:1601
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
        5⤵
        
        PID:1602
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
      4⤵
      PID:1603
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
        5⤵
        
        PID:1604
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
      4⤵
      PID:1605
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
        5⤵
        
        PID:1606
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
      4⤵
      PID:1607
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
        5⤵
        
        PID:1608
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
      4⤵
      PID:1610
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
        5⤵
        
        PID:1611
  - - /bin/sh
      sh -c "mkdir -p /usr/bin/dpkgd"
      4⤵
      PID:1612
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin/dpkgd
        5⤵
        Reads runtime system information
        
        PID:1613
  - - /bin/sh
      sh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"
      4⤵
      PID:1614
    - - /usr/bin/cp
        
        cp -f /bin/lsof /usr/bin/dpkgd/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1615
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1616
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1617
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/agent /bin/lsof"
      4⤵
      PID:1619
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/agent /bin/lsof
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1620
  - - /bin/sh
      sh -c "chmod 0755 /bin/lsof"
      4⤵
      PID:1621
    - - /usr/bin/chmod
        
        chmod 0755 /bin/lsof
        5⤵
        
        PID:1622
  - - /bin/sh
      sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
      4⤵
      PID:1623
    - - /usr/bin/cp
        
        cp -f /bin/ps /usr/bin/dpkgd/ps
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1624
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1626
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1627
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/agent /bin/ps"
      4⤵
      PID:1628
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/agent /bin/ps
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1629
  - - /bin/sh
      sh -c "chmod 0755 /bin/ps"
      4⤵
      PID:1630
    - - /usr/bin/chmod
        
        chmod 0755 /bin/ps
        5⤵
        
        PID:1631
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1632
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1633
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/agent /usr/bin/lsof"
      4⤵
      PID:1635
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/agent /usr/bin/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1636
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/lsof"
      4⤵
      PID:1637
    - - /usr/bin/chmod
        
        chmod 0755 /usr/bin/lsof
        5⤵
        
        PID:1638
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1639
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1640
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/agent /usr/bin/ps"
      4⤵
      PID:1642
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/agent /usr/bin/ps
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1643
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/ps"
      4⤵
      PID:1644
    - - /usr/bin/chmod
        
        chmod 0755 /usr/bin/ps
        5⤵
        
        PID:1645
  - - /bin/sh
      sh -c "insmod /usr/lib/xpacket.ko"
      4⤵
      PID:1646
    - - /usr/sbin/insmod
        
        insmod /usr/lib/xpacket.ko
        5⤵
        Reads runtime system information
        
        PID:1647
- /bin/sh
  sh -c "mkdir -p /usr/bin"
  2⤵
  PID:1588
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:1589
- /bin/sh
  sh -c "cp -f /tmp/bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118 /usr/bin/acpid"
  2⤵
  PID:1590
- - /usr/bin/cp
    cp -f /tmp/bbb3b0d220b420d93bc8cb84a8796b99_JaffaCakes118 /usr/bin/acpid
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1591
- /bin/sh
  sh -c /usr/bin/acpid
  2⤵
  PID:1593
- - /usr/bin/acpid
    /usr/bin/acpid
    3⤵
    - Executes dropped EXE
    - Reads runtime system information
    - Writes file to tmp directory
    PID:1594
- /bin/sh
  sh -c "insmod /usr/lib/xpacket.ko"
  2⤵
  PID:1596
- - /usr/sbin/insmod
    insmod /usr/lib/xpacket.ko
    3⤵
    - Reads runtime system information
    PID:1597

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecurityMdt

Filesize
64B

MD5
68c42fcdcf44e7b40dd12fc55734710a

SHA1
d9a5cf9715a3bbc803acd26a537673bd992349b9

SHA256
31c74c5b130585e5fb7844b00e5e84bd190d6c185113ec1d7aefd5a7a4407d14

SHA512
d161174619f7460d8e6e04b46053308d259ae4a296548b2771898f67ff92025b61c638793a9411420c5652849b8f8a9909623d2a8840339d5d23b2ea62675e87

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
c6a80f08539a4c3176762f514976dd24

SHA1
bbc5826b01d20f5c4d315ff5dbc3f216760c64ef

SHA256
ea47e885ae227059ce55d020335f7869c565ec6d85f484497e83cd4998149d5d

SHA512
9a1e3b0142876305fe389e07880bd586e97bf709273a66299d9128ff2861459104054d4e5d836aecdf73f2c11886fa3a2a8498741adb3211b96116658b856175

Download Submit
/tmp/gates.note

Filesize
4B

MD5
d961e9f236177d65d21100592edb0769

SHA1
c04038a9efd402b01f5733a5df5e0248d29a1ad8

SHA256
956b130106fbc0890b7a304b19113843e5cdc69b084ae1b95d56225650c180a0

SHA512
70e7456b1052bd368f779e1a20dba06bba7f461344b5968139cc4b9553425ff98fa0d8f83df1e227ea04df8813b1f56a7e72930fd72478bd9aefcc9e334df146

Download Submit
/tmp/moni.note

Filesize
4B

MD5
d88518acbcc3d08d1f18da62f9bb26ec

SHA1
060c7c9aea07bd061c43b93a8d51cc043855d7a3

SHA256
c6bb15225eca43aca18f2ceb395c34012a6f95fe76c097576c04be49f5875fa3

SHA512
662922a2416e7ec92897016d5125648a6ad39025d7fe0f110223694d5b6194cb99eb0fe6a08c094c0a52978252a0a47b77a2d994e8f4302c3821ec15c8a6f42b

Download Submit
/tmp/notify.file

Filesize
51B

MD5
fd826e9839af17328074ad0acdb645a8

SHA1
6d805d03cb0578928a47a41c96c2de0bb4f4e6d4

SHA256
b591887a181e7c736f7f9d59728b6ba4891fe2b57e2a87e2e83ba38f7e60788c

SHA512
5acb76fc42eb4c1d8f8facba8ac7c8acd88a41302a3196051335d7726afa7b432a60935e5cb58f6e7192a13897bbe4df14776c21c5d816931ffcb607f749292e

Download Submit
/usr/bin/bsd-port/agent

Filesize
1.1MB

MD5
bbb3b0d220b420d93bc8cb84a8796b99

SHA1
3f4fa3db400705580431141c5f5180b4a12b0b54

SHA256
63ef4ac602d7419817cbc4c645d96bdd1d326f1f33d2ff5425a16695792139b1

SHA512
1d1f11c5184bcc54467280e9debea7c4e720931ba335a87b5a3f80a74aa5df3d394e75f6510be60fa87726dd502eb3ddceb3f8f99721eae80cd50ac1f5b8c7da

Download Submit
/usr/bin/bsd-port/conf.n

Filesize
69B

MD5
227856889c50184308123071d54e9a8c

SHA1
ef1f44f44c1b9cda768cedbf085d984fac1094c0

SHA256
842f3c609faab1be3d68bf9e9e6fd594be0057450988cc00274c0d8ed5b14345

SHA512
edc405aa41c9bb428455d737bf4e57b3a735a80aafd935b7cdbae0da2f3dc5126e3eb8396b2fe22e1f1680550e9c23830a7214c9ab98e2dde5b9c268d18c9243

Download Submit
/usr/bin/dpkgd/lsof

Filesize
163KB

MD5
ab57b66cc531ae0f996963223e632b60

SHA1
bf7e5becd33f21c2539f5a75ffa0ab61c49c8795

SHA256
2484863a7bfda7f97b90bfd5dfceed4ec9f27dd51f9c5158c8daabbf4309b1df

SHA512
908acef13f3c1d80b7169ec3b16bb67006013453348fff75550bc3c6c2137e798b21d7990edbd5be63d756d9c41b06160aebf38aa80547e4bafa3a62596057f6

Download Submit
/usr/bin/dpkgd/ps

Filesize
138KB

MD5
8146139c2ad7e550b1d1f49480997446

SHA1
074db8890c3227bd8a588417f5b9bde637bcf3af

SHA256
207df9d438f75185ab3af2ab1173d104831a6631c28ef40d38b2ab43de27b40f

SHA512
b6d71d537f593b9af833e6f798e412e95fc486a313414ed8cca9639f61be7ac9dca700e9f861c0d07c7f65b3783127a67f829f422472cad8938ba01d397ab9de

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads