mrblack | efa3e5194615c903c081651d6741553dde31d306711857ae3af2ad8db7c40d1b | Triage

Sharing

General

Target

f645cb31f1bff38648eb413644ae60f0_JaffaCakes118
Size

1.2MB
Sample

240925-sfs9fs1hml
MD5

f645cb31f1bff38648eb413644ae60f0
SHA1

5103449688c87bace93d3bdc10cd23058fa4d944
SHA256

efa3e5194615c903c081651d6741553dde31d306711857ae3af2ad8db7c40d1b
SHA512

1d51c13f6b4391aa88fc8754e16b7400c7ed1c8e86d53e0950df94afbd289b1187569aa42769f88fb7179fd2b186927fa2cb3a95cfe13244b64554a10abe56a8
SSDEEP

24576:e845rUHu6gVJKG75oFpA0VWDX4G2y1q2rJp0:7451RVJKGtSA0VWDoVu9p0

Score

10^/10

mrblack antivm botnet defense_evasion discovery linux persistence trojan

Malware Config

Targets

- Target
  
  f645cb31f1bff38648eb413644ae60f0_JaffaCakes118
- Size
  
  1.2MB
- MD5
  
  f645cb31f1bff38648eb413644ae60f0
- SHA1
  
  5103449688c87bace93d3bdc10cd23058fa4d944
- SHA256
  
  efa3e5194615c903c081651d6741553dde31d306711857ae3af2ad8db7c40d1b
- SHA512
  
  1d51c13f6b4391aa88fc8754e16b7400c7ed1c8e86d53e0950df94afbd289b1187569aa42769f88fb7179fd2b186927fa2cb3a95cfe13244b64554a10abe56a8
- SSDEEP
  
  24576:e845rUHu6gVJKG75oFpA0VWDX4G2y1q2rJp0:7451RVJKGtSA0VWDoVu9p0
Score

10^/10

mrblack antivm botnet defense_evasion discovery persistence trojan
- MrBlack Trojan
  IoT botnet which infects routers to be used for DDoS attacks.
  trojan botnet mrblack
- MrBlack trojan
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Modifies init.d
  Adds/modifies system service, likely for persistence.
  persistence
- Reads system routing table
  Gets active network interfaces from /proc virtual filesystem.
  discovery
- Write file to user bin folder
  persistence
- Writes file to system bin folder
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Boot or Logon Initialization Scripts

RC Scripts

Privilege Escalation

Boot or Logon Autostart Execution

Boot or Logon Initialization Scripts

RC Scripts

Defense Evasion

File and Directory Permissions Modification

Linux and Mac File and Directory Permissions Modification

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Virtualization/Sandbox Evasion

System Checks

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

mrblackantivmbotnetdefense_evasiondiscoverypersistencetrojan