Malware

crondx

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Attackers distribute a custom QEMU-emulated Linux environment via a malicious .lnk file within a phishing email.

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence1

The emulated environment includes "PivotBox" settings with command aliases for direct interaction with the host, and command logs reveal steps like SSH setup, payload execution, and persistence configurations.

T1059.001PowerShellEvidence1

The .lnk file activates PowerShell to extract and run QEMU, renamed as fontdiag.exe, from a large, concealed zip archive.

T1072Software Deployment ToolsEvidence1

Through modifications in startup scripts and the use of SSH keys, they ensure continued access even after reboots.

T1204.002Malicious FileEvidence1

Attackers distribute a custom QEMU-emulated Linux environment via a malicious .lnk file within a phishing email. When executed, this file installs and initiates a QEMU instance...

Stealth

1 technique

T1036MasqueradingEvidence1

The .lnk file activates PowerShell to extract and run QEMU, renamed as fontdiag.exe... Attackers use legitimate software (QEMU) renamed and executed from uncommon directories...

Lateral Movement

2 techniques

T1021.004SSHEvidence1

Attackers use legitimate software (QEMU) renamed and executed from uncommon directories, alongside SSH keys and script modifications, ensuring reliable access and minimal detection.

T1072Software Deployment ToolsEvidence1

Through modifications in startup scripts and the use of SSH keys, they ensure continued access even after reboots.

Collection

1 technique

T1560Archive Collected DataEvidence1

The .lnk file activates PowerShell to extract and run QEMU, renamed as fontdiag.exe, from a large, concealed zip archive.

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence2

the binary appears to be a pre-configured Chisel client designed to connect to a remote Command and Control (C2) server at 18.208.230[.]174 via websockets.

T1105Ingress Tool TransferEvidence1

crondx, a Chisel-based backdoor, establishes a secure C2 channel via websockets, enabling encrypted data exfiltration and further payload deployment.

T1132Data EncodingEvidence1

MITRE ATT&CK Matrix ... Command and Control ... T1132: Data Encoding

T1572Protocol TunnelingEvidence1

Chisel’s design makes it particularly effective for creating covert communication channels and tunneling through firewalls... The attackers’ approach effectively transforms this Chisel client into a full backdoor

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

This setup provides them with persistent, encrypted access to the compromised system that would allow them to manage additional payloads or exfiltrate data at will.

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

contagiodump blogNews

Nov 4, 2024

contagio: 2024-11-04 CRON#TRAP (Emulated Linux Environments) Samples

A Chisel-based backdoor used to establish an encrypted command-and-control channel over websockets, support data exfiltration, and deploy additional payloads from within the emulated Linux environment.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

crondx

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Attackers distribute a custom QEMU-emulated Linux environment via a malicious .lnk file within a phishing email.

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence1

T1059.001PowerShellEvidence1

The .lnk file activates PowerShell to extract and run QEMU, renamed as fontdiag.exe, from a large, concealed zip archive.

T1072Software Deployment ToolsEvidence1

Through modifications in startup scripts and the use of SSH keys, they ensure continued access even after reboots.

T1204.002Malicious FileEvidence1

Attackers distribute a custom QEMU-emulated Linux environment via a malicious .lnk file within a phishing email. When executed, this file installs and initiates a QEMU instance...

Stealth

1 technique

T1036MasqueradingEvidence1

The .lnk file activates PowerShell to extract and run QEMU, renamed as fontdiag.exe... Attackers use legitimate software (QEMU) renamed and executed from uncommon directories...

Lateral Movement

2 techniques

T1021.004SSHEvidence1

Attackers use legitimate software (QEMU) renamed and executed from uncommon directories, alongside SSH keys and script modifications, ensuring reliable access and minimal detection.

T1072Software Deployment ToolsEvidence1

Through modifications in startup scripts and the use of SSH keys, they ensure continued access even after reboots.

Collection

1 technique

T1560Archive Collected DataEvidence1

The .lnk file activates PowerShell to extract and run QEMU, renamed as fontdiag.exe, from a large, concealed zip archive.

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence2

the binary appears to be a pre-configured Chisel client designed to connect to a remote Command and Control (C2) server at 18.208.230[.]174 via websockets.

T1105Ingress Tool TransferEvidence1

crondx, a Chisel-based backdoor, establishes a secure C2 channel via websockets, enabling encrypted data exfiltration and further payload deployment.

T1132Data EncodingEvidence1

MITRE ATT&CK Matrix ... Command and Control ... T1132: Data Encoding

T1572Protocol TunnelingEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

This setup provides them with persistent, encrypted access to the compromised system that would allow them to manage additional payloads or exfiltrate data at will.

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

contagiodump blogNews

Nov 4, 2024

contagio: 2024-11-04 CRON#TRAP (Emulated Linux Environments) Samples

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.