Overview

overview

6

Static

static

1

nyx_bot_li...ec.elf

debian-9-mips

6

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    22/10/2026, 18:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    nyx_bot_linux_mips_exec.elf
  • Size 6.6MB
  • Sample261022-w23a2abb64
  • SHA256 3ea89597e075923d11bb7d29eaf29aa78aa5189ed62f941458fb3b739e36cabb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates kernel/hardware configuration 1 TTPs 7 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 26 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/nyx_bot_linux_mips_exec.elf
    /tmp/nyx_bot_linux_mips_exec.elf
    1⤵
    • Enumerates kernel/hardware configuration
    • System Network Configuration Discovery
    PID:714
    • /tmp/nyx_bot_linux_mips_exec.elf
      /tmp/nyx_bot_linux_mips_exec.elf
      2⤵
      • Enumerates kernel/hardware configuration
      • System Network Configuration Discovery
      PID:724
      • /bin/systemctl
        systemctl daemon-reload
        3⤵
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:729
      • /bin/systemctl
        systemctl enable --now nyx-agent.service
        3⤵
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:761
      • /usr/sbin/update-rc.d
        update-rc.d nyx-agent defaults
        3⤵
          PID:778
          • /usr/local/sbin/systemctl
            systemctl daemon-reload
            4⤵
              PID:781
            • /usr/local/bin/systemctl
              systemctl daemon-reload
              4⤵
                PID:781
              • /usr/sbin/systemctl
                systemctl daemon-reload
                4⤵
                  PID:781
                • /usr/bin/systemctl
                  systemctl daemon-reload
                  4⤵
                    PID:781
                  • /sbin/systemctl
                    systemctl daemon-reload
                    4⤵
                      PID:781
                    • /bin/systemctl
                      systemctl daemon-reload
                      4⤵
                      • Enumerates kernel/hardware configuration
                      • Reads runtime system information
                      PID:781
                  • /bin/systemctl
                    systemctl --user daemon-reload
                    3⤵
                    • Enumerates kernel/hardware configuration
                    • Reads runtime system information
                    PID:794
                  • /bin/systemctl
                    systemctl --user enable --now nyx-agent.service
                    3⤵
                    • Enumerates kernel/hardware configuration
                    • Reads runtime system information
                    PID:795
                  • /usr/bin/crontab
                    crontab -l
                    3⤵
                    • Reads runtime system information
                    PID:798
                  • /usr/bin/crontab
                    crontab -
                    3⤵
                    • Creates/modifies Cron job
                    • Reads runtime system information
                    PID:799

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    nyx-agent
                    • Path /etc/cron.d/nyx-agent
                    • Size 74B
                    • SHA256 f3587fd346d989ebeafeb6ba47373ac63e5b643ef95bda4e565a0319750b2c95
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    nyx-agent
                    • Path /etc/init.d/nyx-agent
                    • Size 492B
                    • SHA256 638b599bc990ffb321d8569ce62f11d660156569553f6566df38fb2537109f71
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    rc.local
                    • Path /etc/rc.local
                    • Size 45B
                    • SHA256 e413dbf4f89ac35e0de036f1b2a928df24d409cad3e5120f090f2b038c6c00be
                    • MD5 SHA1 SHA512
                    Submit Download

                    nyx-agent.service
                    • Path /etc/systemd/system/nyx-agent.service
                    • Size 181B
                    • SHA256 60ea76202626fbd4df043ee7ac64dab9d943d50e5b71436f67b3266a8ab6ce24
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    nyx-agent.desktop
                    • Path /tmp/.config/autostart/nyx-agent.desktop
                    • Size 146B
                    • SHA256 091c6d9c5b5621337c14e4fa2f85ba11ddf1c314ee76e0bd35c681a647c0d03c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    nyx-agent.service
                    • Path /tmp/.config/systemd/user/nyx-agent.service
                    • Size 145B
                    • SHA256 713afc3b913f36f3277c4e2ac7c2c3e3ab005490d25df7441e50c60cdde07750
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    tmp.p9MN4Z
                    • Path /var/spool/cron/crontabs/tmp.p9MN4Z
                    • Size 245B
                    • SHA256 64921b3942228a669a87ef78151d4f8052343caa848fcf059b4129b7ced3bd7a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download