mrblack | 13b31c857ca874127126dc16929e7a281f97d2dc84650fb5898bd41572efc7a8 | Triage

Sharing

General

Target

ecd85f48177089d1e7672cf04d91b8ec_JaffaCakes118
Size

1.1MB
Sample

240920-e4y8qaydld
MD5

ecd85f48177089d1e7672cf04d91b8ec
SHA1

1de79f6fd9322ce3a3716e24bda666a7b97ed293
SHA256

13b31c857ca874127126dc16929e7a281f97d2dc84650fb5898bd41572efc7a8
SHA512

5de0f0aebd0b9daaa06cc2cd1773bb6fe39f5dc1d7d58f423b77d73a966575cc70958275aee8ccbbadfcd07841e99b92d6d84c5fc4a7864a6af5c23e4750ca0c
SSDEEP

24576:4vRE7caCfKGPqVEDNLFxKsfaJI+gIGYuuCol7r:4vREKfPqVE5jKsfaJRHGVo7r

Score

10^/10

mrblack antivm botnet defense_evasion discovery linux persistence trojan

Malware Config

Targets

- Target
  
  ecd85f48177089d1e7672cf04d91b8ec_JaffaCakes118
- Size
  
  1.1MB
- MD5
  
  ecd85f48177089d1e7672cf04d91b8ec
- SHA1
  
  1de79f6fd9322ce3a3716e24bda666a7b97ed293
- SHA256
  
  13b31c857ca874127126dc16929e7a281f97d2dc84650fb5898bd41572efc7a8
- SHA512
  
  5de0f0aebd0b9daaa06cc2cd1773bb6fe39f5dc1d7d58f423b77d73a966575cc70958275aee8ccbbadfcd07841e99b92d6d84c5fc4a7864a6af5c23e4750ca0c
- SSDEEP
  
  24576:4vRE7caCfKGPqVEDNLFxKsfaJI+gIGYuuCol7r:4vREKfPqVE5jKsfaJRHGVo7r
Score

10^/10

mrblack antivm botnet defense_evasion discovery persistence trojan
- MrBlack Trojan
  IoT botnet which infects routers to be used for DDoS attacks.
  trojan botnet mrblack
- MrBlack trojan
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Modifies init.d
  Adds/modifies system service, likely for persistence.
  persistence
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
- Write file to user bin folder
  persistence
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Boot or Logon Initialization Scripts

RC Scripts

Privilege Escalation

Boot or Logon Autostart Execution

Boot or Logon Initialization Scripts

RC Scripts

Defense Evasion

File and Directory Permissions Modification

Linux and Mac File and Directory Permissions Modification

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Virtualization/Sandbox Evasion

System Checks

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

mrblackantivmbotnetdefense_evasiondiscoverypersistencetrojan