Overview

overview

6

Static

static

1

3ea89597e0...36cabb

debian-9-mips

6

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    20/10/2026, 10:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3ea89597e075923d11bb7d29eaf29aa78aa5189ed62f941458fb3b739e36cabb
  • Size 6.6MB
  • Sample261020-mc8bbact9l
  • SHA256 3ea89597e075923d11bb7d29eaf29aa78aa5189ed62f941458fb3b739e36cabb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates kernel/hardware configuration 1 TTPs 7 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 26 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/3ea89597e075923d11bb7d29eaf29aa78aa5189ed62f941458fb3b739e36cabb
    /tmp/3ea89597e075923d11bb7d29eaf29aa78aa5189ed62f941458fb3b739e36cabb
    1⤵
    • Enumerates kernel/hardware configuration
    PID:717
    • /tmp/3ea89597e075923d11bb7d29eaf29aa78aa5189ed62f941458fb3b739e36cabb
      /tmp/3ea89597e075923d11bb7d29eaf29aa78aa5189ed62f941458fb3b739e36cabb
      2⤵
      • Enumerates kernel/hardware configuration
      PID:725
      • /bin/systemctl
        systemctl daemon-reload
        3⤵
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:733
      • /bin/systemctl
        systemctl enable --now nyx-agent.service
        3⤵
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:761
      • /usr/sbin/update-rc.d
        update-rc.d nyx-agent defaults
        3⤵
          PID:779
          • /usr/local/sbin/systemctl
            systemctl daemon-reload
            4⤵
              PID:782
            • /usr/local/bin/systemctl
              systemctl daemon-reload
              4⤵
                PID:782
              • /usr/sbin/systemctl
                systemctl daemon-reload
                4⤵
                  PID:782
                • /usr/bin/systemctl
                  systemctl daemon-reload
                  4⤵
                    PID:782
                  • /sbin/systemctl
                    systemctl daemon-reload
                    4⤵
                      PID:782
                    • /bin/systemctl
                      systemctl daemon-reload
                      4⤵
                      • Enumerates kernel/hardware configuration
                      • Reads runtime system information
                      PID:782
                  • /bin/systemctl
                    systemctl --user daemon-reload
                    3⤵
                    • Enumerates kernel/hardware configuration
                    • Reads runtime system information
                    PID:799
                  • /bin/systemctl
                    systemctl --user enable --now nyx-agent.service
                    3⤵
                    • Enumerates kernel/hardware configuration
                    • Reads runtime system information
                    PID:800
                  • /usr/bin/crontab
                    crontab -l
                    3⤵
                    • Reads runtime system information
                    PID:802
                  • /usr/bin/crontab
                    crontab -
                    3⤵
                    • Creates/modifies Cron job
                    • Reads runtime system information
                    PID:804

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    nyx-agent
                    • Path /etc/cron.d/nyx-agent
                    • Size 111B
                    • SHA256 4500d122bba962c8bee39521b4bd2e8776bbb759bcf954a1f4bab9f9c0b78333
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    nyx-agent
                    • Path /etc/init.d/nyx-agent
                    • Size 566B
                    • SHA256 2af7ba1cd94847c7482c7500f4c413906c156d17479ba9e4ab201ca931004314
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    rc.local
                    • Path /etc/rc.local
                    • Size 82B
                    • SHA256 c666ea3e8165108883adc7ecab63036b9e0c542a83596feec555943b85c288d3
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    nyx-agent.service
                    • Path /etc/systemd/system/nyx-agent.service
                    • Size 218B
                    • SHA256 907a4e348599e141de84d80cf7aace8a1e9275f1e81b0f3d9ab74b1487c2a1b8
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    nyx-agent.desktop
                    • Path /tmp/.config/autostart/nyx-agent.desktop
                    • Size 183B
                    • SHA256 6560298869e46913d549fc5ec7d0451ec679e3717a1d39c957913df8f46bcb62
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    nyx-agent.service
                    • Path /tmp/.config/systemd/user/nyx-agent.service
                    • Size 182B
                    • SHA256 5c85df68dc892e555e61b9d0163a2c16c759716471045a1ea94ae7ea4c6f0eb3
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    tmp.yzqWJE
                    • Path /var/spool/cron/crontabs/tmp.yzqWJE
                    • Size 282B
                    • SHA256 ec4b3798ab0b2a5de6a00a6fcaeb91025ab3dc8674dfbeb4c9f7c68e98e2be4a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download