Overview

overview

6

Static

static

1

nyx_bot_li...df.elf

ubuntu-18.04-amd64

6

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20261019-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    22/10/2026, 18:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    nyx_bot_linux_amd64_hkdf.elf
  • Size 6.1MB
  • Sample261022-w2vaesbb44
  • SHA256 0a5d7cded8fb6c6c8281f23c194e40666ad5620e7a75a005af9f1dd81fe4899c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Creates a desktop entry file 3 TTPs 1 IoCs

    A .desktop file is used by desktop environments to register and launch applications. This can be abused to gain persistence.

    persistenceexecution
  • Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 30 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/nyx_bot_linux_amd64_hkdf.elf
    /tmp/nyx_bot_linux_amd64_hkdf.elf
    1⤵
    • Enumerates kernel/hardware configuration
    • Writes file to tmp directory
    PID:1511
    • /tmp/nyx_bot_linux_amd64_hkdf.elf
      /tmp/nyx_bot_linux_amd64_hkdf.elf
      2⤵
      • Creates/modifies Cron job
      • Modifies init.d
      • Modifies rc script
      • Modifies systemd
      • Creates a desktop entry file
      • Enumerates kernel/hardware configuration
      • Writes file to tmp directory
      PID:1515
      • /bin/systemctl
        systemctl daemon-reload
        3⤵
        • Reads runtime system information
        PID:1519
      • /bin/systemctl
        systemctl enable --now nyx-agent.service
        3⤵
        • Reads runtime system information
        PID:1547
      • /usr/sbin/update-rc.d
        update-rc.d nyx-agent defaults
        3⤵
          PID:1572
          • /usr/local/sbin/systemctl
            systemctl daemon-reload
            4⤵
              PID:1573
            • /usr/local/bin/systemctl
              systemctl daemon-reload
              4⤵
                PID:1573
              • /usr/sbin/systemctl
                systemctl daemon-reload
                4⤵
                  PID:1573
                • /usr/bin/systemctl
                  systemctl daemon-reload
                  4⤵
                    PID:1573
                  • /sbin/systemctl
                    systemctl daemon-reload
                    4⤵
                      PID:1573
                    • /bin/systemctl
                      systemctl daemon-reload
                      4⤵
                      • Reads runtime system information
                      PID:1573
                  • /bin/systemctl
                    systemctl --user daemon-reload
                    3⤵
                    • Reads runtime system information
                    PID:1594
                  • /bin/systemctl
                    systemctl --user enable --now nyx-agent.service
                    3⤵
                    • Reads runtime system information
                    PID:1595
                  • /usr/bin/crontab
                    crontab -l
                    3⤵
                      PID:1596
                    • /usr/bin/crontab
                      crontab -
                      3⤵
                      • Creates/modifies Cron job
                      PID:1597

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Scheduled Task/Job

                      1
                      T1053

                      Cron

                      1
                      T1053.003

                      User Execution

                      2
                      T1204

                      Malicious File

                      1
                      T1204.002

                      Persistence

                      Boot or Logon Autostart Execution

                      4
                      T1547

                      XDG Autostart Entries

                      2
                      T1547.013

                      Boot or Logon Initialization Scripts

                      2
                      T1037

                      RC Scripts

                      2
                      T1037.004

                      Create or Modify System Process

                      1
                      T1543

                      Systemd Service

                      1
                      T1543.002

                      Scheduled Task/Job

                      1
                      T1053

                      Cron

                      1
                      T1053.003

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      4
                      T1547

                      XDG Autostart Entries

                      2
                      T1547.013

                      Boot or Logon Initialization Scripts

                      2
                      T1037

                      RC Scripts

                      2
                      T1037.004

                      Create or Modify System Process

                      1
                      T1543

                      Systemd Service

                      1
                      T1543.002

                      Scheduled Task/Job

                      1
                      T1053

                      Cron

                      1
                      T1053.003

                      Defense Evasion

                      Credential Access

                      Discovery

                      System Information Discovery

                      1
                      T1082

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      nyx-agent
                      • Path /etc/cron.d/nyx-agent
                      • Size 75B
                      • SHA256 3ed8382cc9e89f302c365f09290df3ae648cf5f76895893a5dc1db0e17ccabe3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      nyx-agent
                      • Path /etc/init.d/nyx-agent
                      • Size 494B
                      • SHA256 1a6e62294132d5012dd9d1affe2b19dcc5869d9bcafba4a53ae3c6b675d47460
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      nyx-agent.service
                      • Path /etc/systemd/system/nyx-agent.service
                      • Size 182B
                      • SHA256 bba7bf34b8116e89f2424f1a49e4b5b37a44e10f420da590b56dbd91c01b5468
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      nyx-agent.desktop
                      • Path /tmp/.config/autostart/nyx-agent.desktop
                      • Size 147B
                      • SHA256 6c8c2caa7d8f4d6fb7abf5aa42587e31c4dc83ab0ae2b968951bcdc65b4bf2ee
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      nyx-agent.service
                      • Path /tmp/.config/systemd/user/nyx-agent.service
                      • Size 146B
                      • SHA256 fff41b728df3f7cca9de6aa7eb65fa2292fcac80bfeaeac3aa27a54f13124908
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      tmp.5Y2w93
                      • Path /var/spool/cron/crontabs/tmp.5Y2w93
                      • Size 246B
                      • SHA256 8dde310c3a7ecc66d3fa15f5808c83754b6a127b2cc089a3891783856746cb76
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download