mrblack | 7a9138408d453e5ac46d2ef6c02e2dc8b7eff1510462cff9be8608b85d5e2929

Analysis

max time kernel
149s
max time network
146s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20250619-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20250619-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
01/11/2025, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_3270f2db7ee82e4339dd6d8bf4ab4bb6
Size 1.2MB
Sample251101-p4dxwsvnet
SHA256 7a9138408d453e5ac46d2ef6c02e2dc8b7eff1510462cff9be8608b85d5e2929
MD5 3270f2db7ee82e4339dd6d8bf4ab4bb6
SHA1 c6b3c480e180530afbdd28df43c6c2a834ec8d15
SHA512 15230de760ae9a932a2b713a3ca9c96ee21ba550ecde8d239606adbe7df7e8d0e537531ef4182ff77fdcce4d7939a7079f46601aceafe83f65616c505af2131a
SSDEEP 24576:e845rlHu6gVJKG75oFpA0VWIX4G2y1q2rJp0:745wRVJKGtSA0VWIoVu9p0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

antivm botnet defense_evasion discovery mrblack persistence trojan

Malware Config

Signatures

MrBlack Trojan
IoT botnet which infects routers to be used for DDoS attacks.
trojan botnet mrblack

MrBlack trojan 1 IoCs

resource	yara_rule
behavioral1/files/fstream-4.dat	family_mrblack

Mrblack family
mrblack

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1584	chmod
1594	chmod
1574	chmod

Executes dropped EXE 2 IoCs

ioc	pid
/usr/bin/bsd-port/getty	1542
/usr/bin/.sshd	1568

Modifies init.d 2 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc
File opened for modification	/etc/init.d/DbSecuritySpt
File opened for modification	/etc/init.d/selinux

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc
File opened for reading	/proc/net/route

Write file to user bin folder 8 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/dpkgd/ss	cp
File opened for modification	/usr/bin/dpkgd/lsof	cp
File opened for modification	/usr/bin/lsof	cp
File opened for modification	/usr/bin/bsd-port/getty.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/udevd.lock	Process not Found
File opened for modification	/usr/bin/bsd-port/getty	cp
File opened for modification	/usr/bin/.sshd	cp
File opened for modification	/usr/bin/dpkgd/ps	cp

Writes file to system bin folder 2 IoCs

description	ioc	Process
File opened for modification	/bin/ps	cp
File opened for modification	/bin/ss	cp

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc
File opened for reading	/proc/cpuinfo

Reads system network configuration 1 TTPs 3 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc
File opened for reading	/proc/net/dev
File opened for reading	/proc/net/route
File opened for reading	/proc/net/arp

Reads runtime system information 23 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/stat	Process not Found
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/meminfo	Process not Found
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/cmdline	insmod
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/moni.lod
File opened for modification	/tmp/bill.lock
File opened for modification	/tmp/gates.lod
File opened for modification	/tmp/notify.file
File opened for modification	/tmp/conf.n

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt
1⤵
PID:1525

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt
1⤵
PID:1527

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt
1⤵
PID:1529

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt
1⤵
PID:1531

/bin/ln
ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt
1⤵
PID:1533

/bin/mkdir
mkdir -p /usr/bin/bsd-port
1⤵
- Reads runtime system information
PID:1535

/bin/mkdir
mkdir -p /usr/bin/bsd-port
1⤵
- Reads runtime system information
PID:1537

/bin/cp
cp -f /tmp/JaffaCakes118_3270f2db7ee82e4339dd6d8bf4ab4bb6 /usr/bin/bsd-port/getty
1⤵
- Write file to user bin folder
- Reads runtime system information
PID:1539

/bin/mkdir
mkdir -p /usr/bin
1⤵
- Reads runtime system information
PID:1545

/bin/mkdir
mkdir -p /usr/bin
1⤵
- Reads runtime system information
PID:1547

/bin/cp
cp -f /tmp/JaffaCakes118_3270f2db7ee82e4339dd6d8bf4ab4bb6 /usr/bin/.sshd
1⤵
- Write file to user bin folder
- Reads runtime system information
PID:1549

/bin/ln
ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux
1⤵
PID:1551

/bin/ln
ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux
1⤵
PID:1553

/bin/ln
ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux
1⤵
PID:1555

/bin/ln
ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux
1⤵
PID:1557

/bin/ln
ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux
1⤵
PID:1559

/bin/mkdir
mkdir -p /usr/bin/dpkgd
1⤵
- Reads runtime system information
PID:1561

/bin/cp
cp -f /bin/ps /usr/bin/dpkgd/ps
1⤵
- Write file to user bin folder
- Reads runtime system information
PID:1563

/bin/mkdir
mkdir -p /bin
1⤵
- Reads runtime system information
PID:1565

/bin/mkdir
mkdir -p /bin
1⤵
- Reads runtime system information
PID:1570

/bin/cp
cp -f /usr/bin/bsd-port/getty /bin/ps
1⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1572

/bin/chmod
chmod 0755 /bin/ps
1⤵
- File and Directory Permissions Modification
PID:1574

/bin/cp
cp -f /bin/ss /usr/bin/dpkgd/ss
1⤵
- Write file to user bin folder
- Reads runtime system information
PID:1576

/bin/mkdir
mkdir -p /bin
1⤵
- Reads runtime system information
PID:1578

/bin/mkdir
mkdir -p /bin
1⤵
- Reads runtime system information
PID:1580

/bin/cp
cp -f /usr/bin/bsd-port/getty /bin/ss
1⤵
- Writes file to system bin folder
- Reads runtime system information
PID:1582

/bin/chmod
chmod 0755 /bin/ss
1⤵
- File and Directory Permissions Modification
PID:1584

/bin/cp
cp -f /usr/bin/lsof /usr/bin/dpkgd/lsof
1⤵
- Write file to user bin folder
- Reads runtime system information
PID:1586

/bin/mkdir
mkdir -p /usr/bin
1⤵
- Reads runtime system information
PID:1588

/bin/mkdir
mkdir -p /usr/bin
1⤵
- Reads runtime system information
PID:1590

/bin/cp
cp -f /usr/bin/bsd-port/getty /usr/bin/lsof
1⤵
- Write file to user bin folder
- Reads runtime system information
PID:1592

/bin/chmod
chmod 0755 /usr/bin/lsof
1⤵
- File and Directory Permissions Modification
PID:1594

/sbin/insmod
insmod /usr/bin/bsd-port/xpacket.ko
1⤵
- Reads runtime system information
PID:1598

/sbin/insmod
insmod /tmp/xpacket.ko
1⤵
- Reads runtime system information
PID:1609

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DbSecuritySpt

Path /etc/init.d/DbSecuritySpt
Size 64B
SHA256 b22ca5b66d32c5f699548f0fd71c2f3b5c1429028c1deccbfaa4732170166b23
MD5 0320ccf7354ff608d663ea24d6c7b045
SHA1 40ab89bd80795255a4a409ae301900acca29114f
SHA512 827f30556cca66848825e0790586ce0ccf26fe54e572400f27875e1cbc6bfd6b1079b7463388799592c2dd87c00d1082215a8979f10b58726e96538e250d69c5
MD5 SHA1 SHA512

Submit Download

selinux

Path /etc/init.d/selinux
Size 36B
SHA256 8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
MD5 993cc15058142d96c3daf7852c3d5ee8
SHA1 0950b8b391b04dd3895ea33cd3141543ebd2525d
SHA512 0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928
MD5 SHA1 SHA512

Submit Download

gates.lod

Path /tmp/gates.lod
Size 4B
SHA256 ee9c43424bb4c242e06f1b84ca7992822f47b6f5f005af866ec6a684382c9547
MD5 5607fe8879e4fd269e88387e8cb30b7e
SHA1 b43f3811ec0a7d607f7e654ec866167acb42336b
SHA512 6a3276533f63f4f938d83baa0ae617fa33873157091e4122214aa046a6d9f802d213717ed8a46a3ed877e2d377cbf1091caf092e193440bdd4fbef2abfe765c7
MD5 SHA1 SHA512

Submit Download

moni.lod

Path /tmp/moni.lod
Size 4B
SHA256 c6bb15225eca43aca18f2ceb395c34012a6f95fe76c097576c04be49f5875fa3
MD5 d88518acbcc3d08d1f18da62f9bb26ec
SHA1 060c7c9aea07bd061c43b93a8d51cc043855d7a3
SHA512 662922a2416e7ec92897016d5125648a6ad39025d7fe0f110223694d5b6194cb99eb0fe6a08c094c0a52978252a0a47b77a2d994e8f4302c3821ec15c8a6f42b
MD5 SHA1 SHA512

Submit Download

notify.file

Path /tmp/notify.file
Size 51B
SHA256 75049cadfb7f52784b5aabfd279b6a304a81a95b9ff106a49318d56f4f0136b3
MD5 b7f55ad7fc22f6075cc43b11def21d68
SHA1 bbffb5f416edcafcdf03d022aaf8eead1444ea2f
SHA512 856f5b06063491240922957bcb7ef9269ce0ecdcd5fdfb33e1d61c907004f267dcd87954b0fc9e7bf6cd4dcafb955f917aec8efe915a8dae2cb80fa4e4822f9a
MD5 SHA1 SHA512

Submit Download

getty

Path /usr/bin/bsd-port/getty
Size 1.2MB
SHA256 7a9138408d453e5ac46d2ef6c02e2dc8b7eff1510462cff9be8608b85d5e2929
MD5 3270f2db7ee82e4339dd6d8bf4ab4bb6
SHA1 c6b3c480e180530afbdd28df43c6c2a834ec8d15
SHA512 15230de760ae9a932a2b713a3ca9c96ee21ba550ecde8d239606adbe7df7e8d0e537531ef4182ff77fdcce4d7939a7079f46601aceafe83f65616c505af2131a
SSDEEP 24576:e845rlHu6gVJKG75oFpA0VWIX4G2y1q2rJp0:745wRVJKGtSA0VWIoVu9p0
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsof

Path /usr/bin/dpkgd/lsof
Size 159KB
SHA256 1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
MD5 e093dc78225e2a0a25e3b137c1c1e442
SHA1 c29497cfaae729eb576875e4fdfa400640ab16be
SHA512 fe1cc7a65327732eaaee89f427c10239ba822430e34177842f4681068d78d404b1830d808a2a71b1efcc5f126c6d8c053512237421173aaa150e215a672da6f0
SSDEEP 3072:hjPgyal2U77E/kgY4cRur6kgPfavXynehy5frrI3maA4EWy4+Qsp8AY8Vl/2eOmr:hjPfUTu+kSavCn6y5frrI3maA4EWy4+Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /usr/bin/dpkgd/ps
Size 130KB
SHA256 b76435c80333d2c1fd18e0e7682f1c9dfb5da8d507e93e3c416f54b481c428d5
MD5 558edc26f8a38fa9788220b9af8a73e7
SHA1 3024d44e580e9c67f32f6c585d50e2a6cc9a7cac
SHA512 edaa425b441044f015e8f68fffa1664e42372d00dd0e7b0924d24ce947aa8e5f96b3bdc326fa2f8b978e3fcf638a1ceca45a223735db73f1607df66990feb56f
SSDEEP 3072:d/gUagOnBU+N7P2tTJ4hKcsIcKRKrXbys8Z:JgRBd7PcTJrrXb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path /usr/bin/dpkgd/ss
Size 136KB
SHA256 418aae1da62554afe9f260866267af328fd761b3fd6f90f0ea53d543e2fefc38
MD5 1dc929b5f2cd12fe6a2fe71140d2a9e3
SHA1 f9995a92bb201b1b7738a39a38570ef0c40b52d2
SHA512 fbed011c595084548db440dfbe485b7d27032a44a6ae9e141fe43f31c8c524ff9347135ab035deb441fca99e5a3794f7bb9194f148aa2f60f1547a7c67d47373
SSDEEP 3072:mPdG0jQRvX4bYFa16g109+NQvUWsGKIJfokf2X/:mPd21EI9tTYIJfokf2X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads