mrblack | 9d0e5980097d18b384ccac755e546e789337be8512693ae2bbda017447974f70 | Triage

Sharing

General

Target

d5e40f3e2d31e6c6c00d715a028db5bf_JaffaCakes118
Size

1.1MB
Sample

240909-jj34dsxflk
MD5

d5e40f3e2d31e6c6c00d715a028db5bf
SHA1

3ba1bf5b985ab75bbfcd4c36ba3b4f34da2c4179
SHA256

9d0e5980097d18b384ccac755e546e789337be8512693ae2bbda017447974f70
SHA512

660ddf2da470991da7443c284c9fe9087f3913308a3e511429c463a1a0f12bc43b661d52456fdba2695ea3498ac8d18f4bf33285d0b55bd7243b217fe1c69245
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfaqI+gIGYuuCol7r:4vREKfPqVE5jKsfaqRHGVo7r

Score

10^/10

mrblack antivm botnet defense_evasion discovery linux persistence trojan

Malware Config

Targets

- Target
  
  d5e40f3e2d31e6c6c00d715a028db5bf_JaffaCakes118
- Size
  
  1.1MB
- MD5
  
  d5e40f3e2d31e6c6c00d715a028db5bf
- SHA1
  
  3ba1bf5b985ab75bbfcd4c36ba3b4f34da2c4179
- SHA256
  
  9d0e5980097d18b384ccac755e546e789337be8512693ae2bbda017447974f70
- SHA512
  
  660ddf2da470991da7443c284c9fe9087f3913308a3e511429c463a1a0f12bc43b661d52456fdba2695ea3498ac8d18f4bf33285d0b55bd7243b217fe1c69245
- SSDEEP
  
  24576:4vRE7caCfKGPqVEDNLFxKsfaqI+gIGYuuCol7r:4vREKfPqVE5jKsfaqRHGVo7r
Score

10^/10

mrblack antivm botnet defense_evasion discovery persistence trojan
- MrBlack Trojan
  IoT botnet which infects routers to be used for DDoS attacks.
  trojan botnet mrblack
- MrBlack trojan
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Modifies init.d
  Adds/modifies system service, likely for persistence.
  persistence
- Write file to user bin folder
  persistence
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Boot or Logon Initialization Scripts

RC Scripts

Privilege Escalation

Boot or Logon Autostart Execution

Boot or Logon Initialization Scripts

RC Scripts

Defense Evasion

File and Directory Permissions Modification

Linux and Mac File and Directory Permissions Modification

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Virtualization/Sandbox Evasion

System Checks

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

mrblackantivmbotnetdefense_evasiondiscoverypersistencetrojan