Analysis
-
max time kernel
149s -
max time network
142s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
28-06-2024 20:17
Behavioral task
behavioral1
Sample
Aqua.arm7.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
Aqua.arm7.elf
-
Size
153KB
-
MD5
a542b07e5a587db4a8d3a4d843ecfac1
-
SHA1
bf6a26fe29871bcbb5d7aad58591797035c182b5
-
SHA256
61d81c2f32da1ac3033e9132b61926b8342310c6ba2e899773a8d6f078d229f2
-
SHA512
a723fa0b0f4bc26e20691be76996856cd7540f1d8ebd5826f5cdc1da6115e83db59ef384df5c4749e083d70fa5e745f53d8c89f83de36ae93ca1a64579f95337
-
SSDEEP
3072:30MUdi18VNT8aSmiuM1Z9665rhWycqsci/mCGM/9HODF9z+:30MUQ1ad8aSmiuM1/6MWxRci/mrM/9qK
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
pid 647 -
Changes its process name 1 IoCs
Processes:
Aqua.arm7.elfdescription ioc pid process Changes the process name, possibly in an attempt to hide itself httpd 646 Aqua.arm7.elf -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
Aqua.arm7.elfdescription ioc process File opened for reading /proc/6666�4/cmdline Aqua.arm7.elf File opened for reading /proc/6666Z5/cmdline Aqua.arm7.elf File opened for reading /proc/7777�6/cmdline Aqua.arm7.elf File opened for reading /proc/7777�7/stat Aqua.arm7.elf File opened for reading /proc/111�"/cmdline Aqua.arm7.elf File opened for reading /proc/6666?4/cmdline Aqua.arm7.elf File opened for reading /proc/7777\9/stat Aqua.arm7.elf File opened for reading /proc/7777[6/cmdline Aqua.arm7.elf File opened for reading /proc/7777 8/cmdline Aqua.arm7.elf File opened for reading /proc/6666�4/cmdline Aqua.arm7.elf File opened for reading /proc/7777i6/cmdline Aqua.arm7.elf File opened for reading /proc/7777�6/stat Aqua.arm7.elf File opened for reading /proc/77779/stat Aqua.arm7.elf File opened for reading /proc/99/stat Aqua.arm7.elf File opened for reading /proc/66666/stat Aqua.arm7.elf File opened for reading /proc/7777�7/cmdline Aqua.arm7.elf File opened for reading /proc/66/stat Aqua.arm7.elf File opened for reading /proc/444/stat Aqua.arm7.elf File opened for reading /proc/7777n7/stat Aqua.arm7.elf File opened for reading /proc/6666n7/cmdline Aqua.arm7.elf File opened for reading /proc/22/cmdline Aqua.arm7.elf File opened for reading /proc/77774/cmdline Aqua.arm7.elf File opened for reading /proc/77/cmdline Aqua.arm7.elf File opened for reading /proc/2222�+/stat Aqua.arm7.elf File opened for reading /proc/6666N5/cmdline Aqua.arm7.elf File opened for reading /proc/7777�6/stat Aqua.arm7.elf File opened for reading /proc/66/cmdline Aqua.arm7.elf File opened for reading /proc/6666�4/cmdline Aqua.arm7.elf File opened for reading /proc/6666�6/cmdline Aqua.arm7.elf File opened for reading /proc/111�"/cmdline Aqua.arm7.elf File opened for reading /proc/1111�,/cmdline Aqua.arm7.elf File opened for reading /proc/6666=4/stat Aqua.arm7.elf File opened for reading /proc/6666�4/stat Aqua.arm7.elf File opened for reading /proc/1111�"/cmdline Aqua.arm7.elf File opened for reading /proc/7777�5/cmdline Aqua.arm7.elf File opened for reading /proc/2222�*/stat Aqua.arm7.elf File opened for reading /proc/6666�4/cmdline Aqua.arm7.elf File opened for reading /proc/6666�4/cmdline Aqua.arm7.elf File opened for reading /proc/7777 8/stat Aqua.arm7.elf File opened for reading /proc/3333,/cmdline Aqua.arm7.elf File opened for reading /proc/222l�"/stat Aqua.arm7.elf File opened for reading /proc/7777�9/cmdline Aqua.arm7.elf File opened for reading /proc/222�"/cmdline Aqua.arm7.elf File opened for reading /proc/6666p5/stat Aqua.arm7.elf File opened for reading /proc/7777�7/stat Aqua.arm7.elf File opened for reading /proc/1111}%/cmdline Aqua.arm7.elf File opened for reading /proc/6666n7/stat Aqua.arm7.elf File opened for reading /proc/7777R8/stat Aqua.arm7.elf File opened for reading /proc/77773/cmdline Aqua.arm7.elf File opened for reading /proc/7777o7/cmdline Aqua.arm7.elf File opened for reading /proc/222�"/stat Aqua.arm7.elf File opened for reading /proc/66665/stat Aqua.arm7.elf File opened for reading /proc/77/stat Aqua.arm7.elf File opened for reading /proc/111m�"/stat Aqua.arm7.elf File opened for reading /proc/2222*/cmdline Aqua.arm7.elf File opened for reading /proc/3333/stat Aqua.arm7.elf File opened for reading /proc/111/cmdline Aqua.arm7.elf File opened for reading /proc/1111�,/cmdline Aqua.arm7.elf File opened for reading /proc/55550/stat Aqua.arm7.elf File opened for reading /proc/5555[0/stat Aqua.arm7.elf File opened for reading /proc/6666�3/stat Aqua.arm7.elf File opened for reading /proc/6666,7/stat Aqua.arm7.elf File opened for reading /proc/7777u7/stat Aqua.arm7.elf File opened for reading /proc/111c�"/stat Aqua.arm7.elf