mrblack | 4d5ffa44be5a98eb77b2efd1d30d5577d4fd7439e7976cf0840a81b82f5971aa

Analysis

max time kernel
149s
max time network
149s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
28-08-2024 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118
Size

1.1MB
MD5

c67271b0f7ffbc565f7d7ccbee12cbab
SHA1

2a4650b048edfec4a508fe758c3adc7e231bc4e9
SHA256

4d5ffa44be5a98eb77b2efd1d30d5577d4fd7439e7976cf0840a81b82f5971aa
SHA512

7269ace3b783a72e899bfa30b6bf95622cc8e594c4ba2cb24b875be230f15ff33c3ebbddbff49a0812bfbb33594039b4951f577f45b58a94d914a8421ac3886c
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfavI+gIGYuuCol7r:4vREKfPqVE5jKsfavRHGVo7r

Score

10^/10

mrblack antivm botnet persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

Processes:

resource	yara_rule
/usr/bin/bsd-port/agent	family_mrblack

Executes dropped EXE 2 IoCs

Processes:

agentacpid

ioc pid process

/usr/bin/bsd-port/agent 1628 agent
/usr/bin/acpid 1636 acpid

ioc	pid	process
/usr/bin/bsd-port/agent	1628	agent
/usr/bin/acpid	1636	acpid

Modifies init.d 1 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

Processes:

agentc67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118

description	ioc	process
File opened for modification	/etc/init.d/selinux	agent
File opened for modification	/etc/init.d/DbSecurityMdt	c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118

Reads system routing table 1 TTPs 2 IoCs
Gets active network interfaces from /proc virtual filesystem.

System Network Configuration Discovery
T1016

Processes:

agentc67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118

description ioc process

File opened for reading /proc/net/route agent
File opened for reading /proc/net/route c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118

description	ioc	process
File opened for reading	/proc/net/route	agent
File opened for reading	/proc/net/route	c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118

Write file to user bin folder 1 TTPs 10 IoCs

Hijack Execution Flow

T1574

Processes:

c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118cpcpagentcpcpcpcp

description	ioc	process
File opened for modification	/usr/bin/bsd-port/agent.conf	c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/udevd.conf	c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/agent	cp
File opened for modification	/usr/bin/acpid	cp
File opened for modification	/usr/bin/bsd-port/agent.conf	agent
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/bsd-port/conf.n	agent
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/ps	cp

Writes file to system bin folder 1 TTPs 2 IoCs

Hijack Execution Flow
T1574

Processes:

cpcp

description ioc process

File opened for modification /bin/ps cp
File opened for modification /bin/lsof cp
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118agent

description ioc process

File opened for reading /proc/cpuinfo c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118
File opened for reading /proc/cpuinfo agent

description	ioc	process
File opened for modification	/bin/ps	cp
File opened for modification	/bin/lsof	cp

description	ioc	process
File opened for reading	/proc/cpuinfo	c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118
File opened for reading	/proc/cpuinfo	agent

Reads system network configuration 1 TTPs 6 IoCs

Uses contents of /proc filesystem to enumerate network settings.

System Network Configuration Discovery

T1016

Processes:

c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118agent

description	ioc	process
File opened for reading	/proc/net/dev	c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118
File opened for reading	/proc/net/dev	agent
File opened for reading	/proc/net/route	agent
File opened for reading	/proc/net/arp	agent
File opened for reading	/proc/net/route	c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118
File opened for reading	/proc/net/arp	c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

Processes:

agentcpmkdirmkdircpcpmkdirinsmodacpidc67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118insmodmkdircpmkdircpmkdirmkdircpcpcp

description	ioc	process
File opened for reading	/proc/sys/kernel/version	agent
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo	agent
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/sys/kernel/version	acpid
File opened for reading	/proc/stat	c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	agent
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/meminfo	c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/version	c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

Processes:

c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118acpid

description	ioc	process
File opened for modification	/tmp/gates.note	c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118
File opened for modification	/tmp/notify.file	c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118
File opened for modification	/tmp/moni.note	acpid
File opened for modification	/tmp/notify.file	acpid
File opened for modification	/tmp/conf.n	c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118
File opened for modification	/tmp/gates.note	acpid
File opened for modification	/tmp/moni.note	c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118
File opened for modification	/tmp/bill.note	c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118

/tmp/c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118
/tmp/c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118
1⤵
- Modifies init.d
- Reads system routing table
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1587
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc1.d/S97DbSecurityMdt"
  2⤵
  PID:1606
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecurityMdt /etc/rc1.d/S97DbSecurityMdt
    3⤵
    PID:1607
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc2.d/S97DbSecurityMdt"
  2⤵
  PID:1608
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecurityMdt /etc/rc2.d/S97DbSecurityMdt
    3⤵
    PID:1609
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc3.d/S97DbSecurityMdt"
  2⤵
  PID:1610
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecurityMdt /etc/rc3.d/S97DbSecurityMdt
    3⤵
    PID:1611
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc4.d/S97DbSecurityMdt"
  2⤵
  PID:1612
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecurityMdt /etc/rc4.d/S97DbSecurityMdt
    3⤵
    PID:1613
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecurityMdt /etc/rc5.d/S97DbSecurityMdt"
  2⤵
  PID:1614
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecurityMdt /etc/rc5.d/S97DbSecurityMdt
    3⤵
    PID:1615
- /bin/sh
  sh -c "mkdir -p /usr/bin/bsd-port"
  2⤵
  PID:1616
- - /usr/bin/mkdir
    mkdir -p /usr/bin/bsd-port
    3⤵
    - Reads runtime system information
    PID:1617
- /bin/sh
  sh -c "cp -f /tmp/c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118 /usr/bin/bsd-port/agent"
  2⤵
  PID:1618
- - /usr/bin/cp
    cp -f /tmp/c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118 /usr/bin/bsd-port/agent
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1619
- /bin/sh
  sh -c /usr/bin/bsd-port/agent
  2⤵
  PID:1627
- - /usr/bin/bsd-port/agent
    /usr/bin/bsd-port/agent
    3⤵
    - Executes dropped EXE
    - Modifies init.d
    - Reads system routing table
    - Write file to user bin folder
    - Checks CPU configuration
    - Reads system network configuration
    - Reads runtime system information
    PID:1628
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
      4⤵
      PID:1647
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
        5⤵
        
        PID:1648
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
      4⤵
      PID:1649
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
        5⤵
        
        PID:1650
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
      4⤵
      PID:1651
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
        5⤵
        
        PID:1652
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
      4⤵
      PID:1653
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
        5⤵
        
        PID:1654
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
      4⤵
      PID:1655
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
        5⤵
        
        PID:1656
  - - /bin/sh
      sh -c "mkdir -p /usr/bin/dpkgd"
      4⤵
      PID:1657
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin/dpkgd
        5⤵
        Reads runtime system information
        
        PID:1658
  - - /bin/sh
      sh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"
      4⤵
      PID:1659
    - - /usr/bin/cp
        
        cp -f /bin/lsof /usr/bin/dpkgd/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1660
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1661
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1662
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/agent /bin/lsof"
      4⤵
      PID:1663
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/agent /bin/lsof
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1664
  - - /bin/sh
      sh -c "chmod 0755 /bin/lsof"
      4⤵
      PID:1665
    - - /usr/bin/chmod
        
        chmod 0755 /bin/lsof
        5⤵
        
        PID:1666
  - - /bin/sh
      sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
      4⤵
      PID:1667
    - - /usr/bin/cp
        
        cp -f /bin/ps /usr/bin/dpkgd/ps
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1668
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1669
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1670
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/agent /bin/ps"
      4⤵
      PID:1671
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/agent /bin/ps
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1672
  - - /bin/sh
      sh -c "chmod 0755 /bin/ps"
      4⤵
      PID:1673
    - - /usr/bin/chmod
        
        chmod 0755 /bin/ps
        5⤵
        
        PID:1674
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1675
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1676
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/agent /usr/bin/lsof"
      4⤵
      PID:1677
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/agent /usr/bin/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1678
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/lsof"
      4⤵
      PID:1680
    - - /usr/bin/chmod
        
        chmod 0755 /usr/bin/lsof
        5⤵
        
        PID:1681
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1682
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1683
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/agent /usr/bin/ps"
      4⤵
      PID:1684
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/agent /usr/bin/ps
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1685
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/ps"
      4⤵
      PID:1686
    - - /usr/bin/chmod
        
        chmod 0755 /usr/bin/ps
        5⤵
        
        PID:1687
  - - /bin/sh
      sh -c "insmod /usr/lib/xpacket.ko"
      4⤵
      PID:1688
    - - /usr/sbin/insmod
        
        insmod /usr/lib/xpacket.ko
        5⤵
        Reads runtime system information
        
        PID:1689
- /bin/sh
  sh -c "mkdir -p /usr/bin"
  2⤵
  PID:1630
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:1631
- /bin/sh
  sh -c "cp -f /tmp/c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118 /usr/bin/acpid"
  2⤵
  PID:1632
- - /usr/bin/cp
    cp -f /tmp/c67271b0f7ffbc565f7d7ccbee12cbab_JaffaCakes118 /usr/bin/acpid
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1633
- /bin/sh
  sh -c /usr/bin/acpid
  2⤵
  PID:1635
- - /usr/bin/acpid
    /usr/bin/acpid
    3⤵
    - Executes dropped EXE
    - Reads runtime system information
    - Writes file to tmp directory
    PID:1636
- /bin/sh
  sh -c "insmod /usr/lib/xpacket.ko"
  2⤵
  PID:1638
- - /usr/sbin/insmod
    insmod /usr/lib/xpacket.ko
    3⤵
    - Reads runtime system information
    PID:1639

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecurityMdt

Filesize
64B

MD5
d3da1d0e6c29a83912ca084d457bdb02

SHA1
01c7ac631235cdac726f532b742ad02126ba1555

SHA256
361ff95c350c3ce3061e46e78574a995ab61ba579ef67071eb1f7c9f2356d382

SHA512
9c4367895598a59e8873b930c14001b7643edaf40407968de7dfb2a08a5faa8904a5272feadb01a70c9712ea87140f446f3bdb6923b60d99225152b3d1fde10f

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
c6a80f08539a4c3176762f514976dd24

SHA1
bbc5826b01d20f5c4d315ff5dbc3f216760c64ef

SHA256
ea47e885ae227059ce55d020335f7869c565ec6d85f484497e83cd4998149d5d

SHA512
9a1e3b0142876305fe389e07880bd586e97bf709273a66299d9128ff2861459104054d4e5d836aecdf73f2c11886fa3a2a8498741adb3211b96116658b856175

Download Submit
/tmp/gates.note

Filesize
4B

MD5
894b77f805bd94d292574c38c5d628d5

SHA1
1784f0e37c1fdd6200c1e8b28e8caae5402e74e0

SHA256
d24eac45e69be063cc0053eb02650954eec62c314c405e564a4d11e951392e75

SHA512
605b8ee18c6bd7c9d489faa803dc4c00fed6e7a4b21a9a69ba7b429642a06d7fe42e5fd45162f72fff76f1ec518c5840399c97d4ab0f7633651d35e2b19f2e05

Download Submit
/tmp/moni.note

Filesize
4B

MD5
52c5189391854c93e8a0e1326e56c14f

SHA1
3d4bce24d3e7869a1459fd4cd1bfe131f5ad2a81

SHA256
274e64235a5fb9590afabdced2d45045b161d75e5748c23d997295e3c8d4fa0f

SHA512
1bbddab4ed685f57b98cd6d5c128cceb0367c939662fdf0896e749c6e564faa0f9f49d207d5b6907d250575468ea46fb2ce6fb2d2b8d31f24a38b16e84fe612e

Download Submit
/tmp/notify.file

Filesize
51B

MD5
add4e75e41749e555031fdb3b983a2c9

SHA1
66ea831239a91c395cd02ea0140f2effa2a69e2a

SHA256
c8b7c175574716d26efd86912bccc048a8c51b68c34f5f30da06f9441e3543df

SHA512
a987166bf22834bde6ff9d60ad13b742501bd973361dc715fd59a309c7fcd215663d500dfc37e4f4ac9b0154d3699ad9e22fd61dd95f6954b01727bd73b41f28

Download Submit
/usr/bin/bsd-port/agent

Filesize
1.1MB

MD5
c67271b0f7ffbc565f7d7ccbee12cbab

SHA1
2a4650b048edfec4a508fe758c3adc7e231bc4e9

SHA256
4d5ffa44be5a98eb77b2efd1d30d5577d4fd7439e7976cf0840a81b82f5971aa

SHA512
7269ace3b783a72e899bfa30b6bf95622cc8e594c4ba2cb24b875be230f15ff33c3ebbddbff49a0812bfbb33594039b4951f577f45b58a94d914a8421ac3886c

Download Submit
/usr/bin/bsd-port/conf.n

Filesize
69B

MD5
e385ca97015f3c790b2476d98918ad31

SHA1
a8fe14d04ce06fa01b5b5a396c7df8ee21d5e1eb

SHA256
b917a6f68cfc35a13a31b9ceaf272d44c95c6485f29a5a7155fe9ffbcffaed6f

SHA512
4c8e102c76c1317318dcd87d80d41f29c7e2e180506ed1449dfcf4614a859ac16d6f587d78879bcfe12c032a97878cca20bda5eba99aa850582e82cafce455d4

Download Submit
/usr/bin/dpkgd/lsof

Filesize
163KB

MD5
ab57b66cc531ae0f996963223e632b60

SHA1
bf7e5becd33f21c2539f5a75ffa0ab61c49c8795

SHA256
2484863a7bfda7f97b90bfd5dfceed4ec9f27dd51f9c5158c8daabbf4309b1df

SHA512
908acef13f3c1d80b7169ec3b16bb67006013453348fff75550bc3c6c2137e798b21d7990edbd5be63d756d9c41b06160aebf38aa80547e4bafa3a62596057f6

Download Submit
/usr/bin/dpkgd/ps

Filesize
138KB

MD5
8146139c2ad7e550b1d1f49480997446

SHA1
074db8890c3227bd8a588417f5b9bde637bcf3af

SHA256
207df9d438f75185ab3af2ab1173d104831a6631c28ef40d38b2ab43de27b40f

SHA512
b6d71d537f593b9af833e6f798e412e95fc486a313414ed8cca9639f61be7ac9dca700e9f861c0d07c7f65b3783127a67f829f422472cad8938ba01d397ab9de

Download Submit