Overview
overview
4Static
static
1URLScan
urlscan
1https://crypto-o.cli...
windows10-1703-x64
1https://crypto-o.cli...
windows7-x64
1https://crypto-o.cli...
windows10-2004-x64
1https://crypto-o.cli...
windows11-21h2-x64
1https://crypto-o.cli...
android-10-x64
1https://crypto-o.cli...
android-11-x64
1https://crypto-o.cli...
android-13-x64
1https://crypto-o.cli...
android-9-x86
1https://crypto-o.cli...
macos-10.15-amd64
4https://crypto-o.cli...
debian-12-armhf
https://crypto-o.cli...
debian-12-mipsel
https://crypto-o.cli...
debian-9-armhf
https://crypto-o.cli...
debian-9-mips
https://crypto-o.cli...
debian-9-mipsel
https://crypto-o.cli...
ubuntu-18.04-amd64
3https://crypto-o.cli...
ubuntu-20.04-amd64
4https://crypto-o.cli...
ubuntu-22.04-amd64
1https://crypto-o.cli...
ubuntu-24.04-amd64
1Analysis
-
max time kernel
0s -
max time network
129s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
23-06-2024 16:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://crypto-o.click/K1XP8K
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
https://crypto-o.click/K1XP8K
Resource
win7-20231129-en
Behavioral task
behavioral3
Sample
https://crypto-o.click/K1XP8K
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
https://crypto-o.click/K1XP8K
Resource
win11-20240611-en
Behavioral task
behavioral5
Sample
https://crypto-o.click/K1XP8K
Resource
android-x64-20240611.1-en
Behavioral task
behavioral6
Sample
https://crypto-o.click/K1XP8K
Resource
android-x64-arm64-20240611.1-en
Behavioral task
behavioral7
Sample
https://crypto-o.click/K1XP8K
Resource
android-33-x64-arm64-20240611.1-en
Behavioral task
behavioral8
Sample
https://crypto-o.click/K1XP8K
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral9
Sample
https://crypto-o.click/K1XP8K
Resource
macos-20240611-en
Behavioral task
behavioral10
Sample
https://crypto-o.click/K1XP8K
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral11
Sample
https://crypto-o.click/K1XP8K
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral12
Sample
https://crypto-o.click/K1XP8K
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral13
Sample
https://crypto-o.click/K1XP8K
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral14
Sample
https://crypto-o.click/K1XP8K
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral15
Sample
https://crypto-o.click/K1XP8K
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral16
Sample
https://crypto-o.click/K1XP8K
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral17
Sample
https://crypto-o.click/K1XP8K
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral18
Sample
https://crypto-o.click/K1XP8K
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
https://crypto-o.click/K1XP8K
Malware Config
Signatures
-
Enumerates kernel/hardware configuration 1 TTPs 46 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
firefoxdescription ioc process File opened for reading /sys/bus/pci/devices/0000:00:01.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/device firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/device firefox File opened for reading /sys/bus/pci/devices firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/device firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/class firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/class firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:03.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:05.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:04.0/class firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/device firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:01.3/irq firefox File opened for reading /sys/bus/pci/devices/0000:00:01.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:00.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:01.1/resource firefox File opened for reading /sys/bus/pci/devices/0000:00:06.0/vendor firefox File opened for reading /sys/bus/pci/devices/0000:00:02.0/vendor firefox -
Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.
Processes:
firefoxdescription ioc process File opened for reading /proc/self/task/1509/stat firefox File opened for reading /proc/self/stat firefox File opened for reading /proc/filesystems firefox
Processes
-
/usr/bin/firefoxfirefox -new-tab https://crypto-o.click/K1XP8K1⤵PID:1507
-
/usr/bin/whichwhich /usr/bin/firefox2⤵PID:1508
-
-
/usr/lib/firefox/firefox/usr/lib/firefox/firefox -new-tab https://crypto-o.click/K1XP8K1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1507