Overview

overview

10

Static

static

10

be9e6e33ce...kes118

ubuntu-22.04-amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    be9e6e33ce58d7572b0a089a9be20dd0_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240824-pzezdssdmn

  • MD5

    be9e6e33ce58d7572b0a089a9be20dd0

  • SHA1

    5f3788156d48b1e1865a471a9a34019aa63f1a1b

  • SHA256

    1ea1b4edcc7e1ba2ba0e549ff3fcdd35efabd69f4e671b905a7d38ec97a7d9d9

  • SHA512

    8b20ab73a1aa5ad3c1cf09af600e538cfb519a509c599ea76a6b07189d04e679112e2c273ed2e8ae1de677af614c74b4332ab973542e0c6bb8d5b5968aa97b07

  • SSDEEP

    24576:4vRE7caCfKGPqVEDNLFxKsfa4I+gIGYuuCol7r:4vREKfPqVE5jKsfa4RHGVo7r

Score
10/10
mrblackantivmbotnetlinuxpersistencetrojan

Malware Config

Targets

    • Target

      be9e6e33ce58d7572b0a089a9be20dd0_JaffaCakes118

    • Size

      1.1MB

    • MD5

      be9e6e33ce58d7572b0a089a9be20dd0

    • SHA1

      5f3788156d48b1e1865a471a9a34019aa63f1a1b

    • SHA256

      1ea1b4edcc7e1ba2ba0e549ff3fcdd35efabd69f4e671b905a7d38ec97a7d9d9

    • SHA512

      8b20ab73a1aa5ad3c1cf09af600e538cfb519a509c599ea76a6b07189d04e679112e2c273ed2e8ae1de677af614c74b4332ab973542e0c6bb8d5b5968aa97b07

    • SSDEEP

      24576:4vRE7caCfKGPqVEDNLFxKsfa4I+gIGYuuCol7r:4vREKfPqVE5jKsfa4RHGVo7r

    Score
    10/10
    mrblackantivmbotnetpersistencetrojan

    • MrBlack Trojan

      IoT botnet which infects routers to be used for DDoS attacks.

      trojanbotnetmrblack

    • MrBlack trojan

    • Executes dropped EXE

    • Modifies init.d

      Adds/modifies system service, likely for persistence.

      persistence

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

    • Write file to user bin folder

    • Writes file to system bin folder

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks