mrblack | bd725c4105df8194d29f7a39bc2356113ed9d840f4629ec222aa1bbd269c9f1a

Analysis

max time kernel
149s
max time network
151s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240729-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
18-09-2024 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118
Size

1.1MB
MD5

e9d0ceb7c823a511a2f59af62cb2186f
SHA1

c59f119553d18aaa69363179506cec8bf1ff5f47
SHA256

bd725c4105df8194d29f7a39bc2356113ed9d840f4629ec222aa1bbd269c9f1a
SHA512

149d5d532252b2d956b0d9c9db09bf4714a6b9fa7d10254ccd6723ceea16aa16d59361a6b3f439839052bbaa28c76069dec62fd05410018ed0429b78c648f70b
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfarI+gIGYuuCol7r:4vREKfPqVE5jKsfarRHGVo7r

Score

10^/10

mrblack antivm botnet defense_evasion discovery persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

Processes:

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

Processes:

chmodshchmodshchmodshchmodsh

pid	Process
1503	chmod
1508	sh
1509	chmod
1514	sh
1515	chmod
1494	sh
1495	chmod
1502	sh

Executes dropped EXE 2 IoCs

Processes:

getty.sshd

ioc	pid	Process
/usr/bin/bsd-port/getty	1455	getty
/usr/bin/.sshd	1463	.sshd

Modifies init.d 2 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

Processes:

e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118getty

description	ioc	Process
File opened for modification	/etc/init.d/DbSecuritySpt	e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118
File opened for modification	/etc/init.d/selinux	getty

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

Processes:

getty

description	ioc	Process
File opened for reading	/proc/net/route	getty

Write file to user bin folder 10 IoCs

persistence

Processes:

cpcpcpcpcpgettye9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118cp

description	ioc	Process
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/ps	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/ps	cp
File opened for modification	/usr/bin/bsd-port/conf.n	getty
File opened for modification	/usr/bin/bsd-port/getty.lock	e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/udevd.lock	e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118
File opened for modification	/usr/bin/bsd-port/getty.lock	getty
File opened for modification	/usr/bin/dpkgd/lsof	cp

Writes file to system bin folder 2 IoCs

Processes:

cpcp

description	ioc	Process
File opened for modification	/bin/lsof	cp
File opened for modification	/bin/ps	cp

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

Processes:

e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118getty

description	ioc	Process
File opened for reading	/proc/cpuinfo	e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118
File opened for reading	/proc/cpuinfo	getty

Reads system network configuration 1 TTPs 4 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

Processes:

e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118getty

description	ioc	Process
File opened for reading	/proc/net/dev	e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118
File opened for reading	/proc/net/dev	getty
File opened for reading	/proc/net/route	getty
File opened for reading	/proc/net/arp	getty

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

cpmkdirinsmodcpcpmkdircpe9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118cpmkdircp.sshdmkdircpmkdirgettymkdircpinsmodmkdir

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/version	e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/version	.sshd
File opened for reading	/proc/meminfo	e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo	getty
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/sys/kernel/version	getty
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/stat	getty
File opened for reading	/proc/stat	e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

Processes:

e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118.sshd

description	ioc	Process
File opened for modification	/tmp/moni.lock	e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118
File opened for modification	/tmp/bill.lock	e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118
File opened for modification	/tmp/gates.lock	e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118
File opened for modification	/tmp/notify.file	e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118
File opened for modification	/tmp/moni.lock	.sshd
File opened for modification	/tmp/notify.file	.sshd
File opened for modification	/tmp/gates.lock	.sshd

/tmp/e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118
/tmp/e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118
1⤵
- Modifies init.d
- Write file to user bin folder
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1398
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt"
  2⤵
  PID:1439
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
    3⤵
    PID:1440
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt"
  2⤵
  PID:1441
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
    3⤵
    PID:1442
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt"
  2⤵
  PID:1443
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
    3⤵
    PID:1444
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt"
  2⤵
  PID:1445
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
    3⤵
    PID:1446
- /bin/sh
  sh -c "ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt"
  2⤵
  PID:1447
- - /usr/bin/ln
    ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
    3⤵
    PID:1448
- /bin/sh
  sh -c "mkdir -p /usr/bin/bsd-port"
  2⤵
  PID:1449
- - /usr/bin/mkdir
    mkdir -p /usr/bin/bsd-port
    3⤵
    - Reads runtime system information
    PID:1450
- /bin/sh
  sh -c "cp -f /tmp/e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118 /usr/bin/bsd-port/getty"
  2⤵
  PID:1451
- - /usr/bin/cp
    cp -f /tmp/e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118 /usr/bin/bsd-port/getty
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1452
- /bin/sh
  sh -c /usr/bin/bsd-port/getty
  2⤵
  PID:1454
- - /usr/bin/bsd-port/getty
    /usr/bin/bsd-port/getty
    3⤵
    - Executes dropped EXE
    - Modifies init.d
    - Reads system routing table
    - Write file to user bin folder
    - Checks CPU configuration
    - Reads system network configuration
    - Reads runtime system information
    PID:1455
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux"
      4⤵
      PID:1475
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
        5⤵
        
        PID:1476
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux"
      4⤵
      PID:1477
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
        5⤵
        
        PID:1478
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux"
      4⤵
      PID:1479
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
        5⤵
        
        PID:1480
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux"
      4⤵
      PID:1481
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
        5⤵
        
        PID:1482
  - - /bin/sh
      sh -c "ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux"
      4⤵
      PID:1483
    - - /usr/bin/ln
        
        ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
        5⤵
        
        PID:1485
  - - /bin/sh
      sh -c "mkdir -p /usr/bin/dpkgd"
      4⤵
      PID:1486
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin/dpkgd
        5⤵
        Reads runtime system information
        
        PID:1487
  - - /bin/sh
      sh -c "cp -f /bin/lsof /usr/bin/dpkgd/lsof"
      4⤵
      PID:1488
    - - /usr/bin/cp
        
        cp -f /bin/lsof /usr/bin/dpkgd/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1489
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1490
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1491
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /bin/lsof"
      4⤵
      PID:1492
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/getty /bin/lsof
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1493
  - - /bin/sh
      sh -c "chmod 0755 /bin/lsof"
      4⤵
      File and Directory Permissions Modification
      PID:1494
    - - /usr/bin/chmod
        
        chmod 0755 /bin/lsof
        5⤵
        File and Directory Permissions Modification
        
        PID:1495
  - - /bin/sh
      sh -c "cp -f /bin/ps /usr/bin/dpkgd/ps"
      4⤵
      PID:1496
    - - /usr/bin/cp
        
        cp -f /bin/ps /usr/bin/dpkgd/ps
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1497
  - - /bin/sh
      sh -c "mkdir -p /bin"
      4⤵
      PID:1498
    - - /usr/bin/mkdir
        
        mkdir -p /bin
        5⤵
        Reads runtime system information
        
        PID:1499
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /bin/ps"
      4⤵
      PID:1500
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/getty /bin/ps
        5⤵
        Writes file to system bin folder
        Reads runtime system information
        
        PID:1501
  - - /bin/sh
      sh -c "chmod 0755 /bin/ps"
      4⤵
      File and Directory Permissions Modification
      PID:1502
    - - /usr/bin/chmod
        
        chmod 0755 /bin/ps
        5⤵
        File and Directory Permissions Modification
        
        PID:1503
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1504
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1505
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/lsof"
      4⤵
      PID:1506
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1507
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/lsof"
      4⤵
      File and Directory Permissions Modification
      PID:1508
    - - /usr/bin/chmod
        
        chmod 0755 /usr/bin/lsof
        5⤵
        File and Directory Permissions Modification
        
        PID:1509
  - - /bin/sh
      sh -c "mkdir -p /usr/bin"
      4⤵
      PID:1510
    - - /usr/bin/mkdir
        
        mkdir -p /usr/bin
        5⤵
        Reads runtime system information
        
        PID:1511
  - - /bin/sh
      sh -c "cp -f /usr/bin/bsd-port/getty /usr/bin/ps"
      4⤵
      PID:1512
    - - /usr/bin/cp
        
        cp -f /usr/bin/bsd-port/getty /usr/bin/ps
        5⤵
        Write file to user bin folder
        Reads runtime system information
        
        PID:1513
  - - /bin/sh
      sh -c "chmod 0755 /usr/bin/ps"
      4⤵
      File and Directory Permissions Modification
      PID:1514
    - - /usr/bin/chmod
        
        chmod 0755 /usr/bin/ps
        5⤵
        File and Directory Permissions Modification
        
        PID:1515
  - - /bin/sh
      sh -c "insmod /usr/lib/xpacket.ko"
      4⤵
      PID:1516
    - - /usr/sbin/insmod
        
        insmod /usr/lib/xpacket.ko
        5⤵
        Reads runtime system information
        
        PID:1517
- /bin/sh
  sh -c "mkdir -p /usr/bin"
  2⤵
  PID:1457
- - /usr/bin/mkdir
    mkdir -p /usr/bin
    3⤵
    - Reads runtime system information
    PID:1458
- /bin/sh
  sh -c "cp -f /tmp/e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118 /usr/bin/.sshd"
  2⤵
  PID:1459
- - /usr/bin/cp
    cp -f /tmp/e9d0ceb7c823a511a2f59af62cb2186f_JaffaCakes118 /usr/bin/.sshd
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:1460
- /bin/sh
  sh -c /usr/bin/.sshd
  2⤵
  PID:1462
- - /usr/bin/.sshd
    /usr/bin/.sshd
    3⤵
    - Executes dropped EXE
    - Reads runtime system information
    - Writes file to tmp directory
    PID:1463
- /bin/sh
  sh -c "insmod /usr/lib/xpacket.ko"
  2⤵
  PID:1465
- - /usr/sbin/insmod
    insmod /usr/lib/xpacket.ko
    3⤵
    - Reads runtime system information
    PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/etc/init.d/DbSecuritySpt

Filesize
64B

MD5
90064bc219f5db26c022a56a80d2fcbe

SHA1
10c728730a789027444fe01c7c997e0f32873b2a

SHA256
0da4e35abd1a34298d2f9c72c061d8e95a56b261041958e8165bc7afd5b06fff

SHA512
f00772c2abbd656edf7a106a1e1c3a60a6b6f6dcee257c29b9cfc3b84315be127608c3e667e33eef5b6655a760cfa2009ec08adb1497e3995a010287ad16524b

Download Submit
/etc/init.d/selinux

Filesize
36B

MD5
993cc15058142d96c3daf7852c3d5ee8

SHA1
0950b8b391b04dd3895ea33cd3141543ebd2525d

SHA256
8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208

SHA512
0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

Download Submit
/tmp/gates.lock

Filesize
4B

MD5
602d1305678a8d5fdb372271e980da6a

SHA1
87b2eb969f96afe3b467215f279262e98c868d27

SHA256
3485da2e4aaa4c692d04e570406af48b512f13137ab9e57718753a7a9f7b6e1c

SHA512
dcdb6d1e88228353412b1a7973492d15d9a7d60e2042851981f9067198f592502538e18683a255e58ab137d49e6882b9171aa5c6b0201782efcbfa4b86f0b05d

Download Submit
/tmp/moni.lock

Filesize
4B

MD5
c913303f392ffc643f7240b180602652

SHA1
655030540aed981b558d2f880b20cca6217d24e6

SHA256
4753e699ede615170936d7dd4c55a57c11c2965a2f8854e9d5738a387aa11e3a

SHA512
a5d67239eab15f51fa903435b3ecee59cdfde6a92eb1c79a294ad0b8d70eb9af1edf0950b6006f6cb41bd2ff7c8624b0b9c99bf0ce1b9393c3e6387888479c3e

Download Submit
/tmp/notify.file

Filesize
51B

MD5
7190c2e6ac3d4e30400315f7e500e49a

SHA1
94c879eb645fd9796c92c6a90d3487ff06eae499

SHA256
38b155816b42328061454419f095a03d7b46d29ad50497d80eef9330b884c221

SHA512
f11b9405048979450744ce03c6a010e7af8746b555ab329b118caff9d555a5524e62f0af1248b532b7b265a78234269fcb7e4d46f3d1d822bf6f21129086248d

Download Submit
/usr/bin/bsd-port/conf.n

Filesize
69B

MD5
2923a1c1a42ef0ab35abeb8ca115db55

SHA1
536528be8dd93273808cd2378125ad5914299c74

SHA256
1212bf4db9efe963d1571cc12754bf1dde999e89df56c2a9defccef41980e87e

SHA512
eac287453eb8fd7c91a4dd9d9fe0148f6f97a3cf7e2c984ee69c74dca04df7ba01b911fe42aed37c9902701960668feb0d6555dba1ea74d72060f3c61d911f0e

Download Submit
/usr/bin/bsd-port/getty

Filesize
1.1MB

MD5
e9d0ceb7c823a511a2f59af62cb2186f

SHA1
c59f119553d18aaa69363179506cec8bf1ff5f47

SHA256
bd725c4105df8194d29f7a39bc2356113ed9d840f4629ec222aa1bbd269c9f1a

SHA512
149d5d532252b2d956b0d9c9db09bf4714a6b9fa7d10254ccd6723ceea16aa16d59361a6b3f439839052bbaa28c76069dec62fd05410018ed0429b78c648f70b

Download Submit
/usr/bin/dpkgd/lsof

Filesize
171KB

MD5
061386937ec7acf924438a2643a32be0

SHA1
01a044b9e58839bea3e58c66cb32acc16241bf91

SHA256
8a26bbae9eb85aa98ef29cfe5b0a291234db6eb394c3e0c2841983dcf7dda959

SHA512
2de2e56ac4c32f47b4a1945ccfb0db378e6d59019ee8004e3e5d2ec8935efb5aa8ee14b8a0b21c61a267e195d42a3232a6dcade8720de06118fd579277f59db7

Download Submit
/usr/bin/dpkgd/ps

Filesize
134KB

MD5
d194576b899af45b1d2a448612ec21e5

SHA1
492f7d8f28cd4397ce22fcf0d8bf3304ea93465a

SHA256
a8cf81f3a1137c999c3cf336507ce120b3065e633ade01db6280d427b7d986ca

SHA512
b323babd9580b91772cde29c9f22ae75b27f5ce8ce0268a48ca41713c3545dd72409932a5c48f6af66ac6e43127eb5461d1f686bd667fa1b0e56a1564db3c539

Download Submit