Analysis
-
max time kernel
145s -
max time network
148s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
06/12/2024, 21:27
Behavioral task
behavioral1
Sample
Aqua.x86_64.elf
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
4 signatures
150 seconds
General
-
Target
Aqua.x86_64.elf
-
Size
170KB
-
MD5
cd6bbd73b40235580ac39ee7187b7330
-
SHA1
c1cbe4c2076e915a7582e0669d7904f8a53060e9
-
SHA256
45d6cbe1c9259d86d563c5e76d70383747ee8c613ef15af8d7ab27cc1ee28c3c
-
SHA512
c6348da638bc2ec66cbfe5ec5b43f5a60a582e0fb12f63201c36477ad0b3b36dfe4e0a2712972945fcc08f87bc46e634462cad92f46c84e1a397bcc850981f87
-
SSDEEP
3072:N8cx757Y4zFY9Drz7xegG1k3QvjCwjgIAKQSDn7I0iMIUcBvKrli2p6dBk0qyl:N8cxd7Y4zFY9Pz7xlG1fFcMIli16dBkS
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1588 Aqua.x86_64.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 1587 Aqua.x86_64.elf -
description ioc Process File opened for reading /proc/3/cmdline Aqua.x86_64.elf File opened for reading /proc/9/cmdline Aqua.x86_64.elf File opened for reading /proc/14/cmdline Aqua.x86_64.elf File opened for reading /proc/74/cmdline Aqua.x86_64.elf File opened for reading /proc/80/cmdline Aqua.x86_64.elf File opened for reading /proc/219/cmdline Aqua.x86_64.elf File opened for reading /proc/225/cmdline Aqua.x86_64.elf File opened for reading /proc/525/cmdline Aqua.x86_64.elf File opened for reading /proc/1108/cmdline Aqua.x86_64.elf File opened for reading /proc/26/cmdline Aqua.x86_64.elf File opened for reading /proc/85/cmdline Aqua.x86_64.elf File opened for reading /proc/96/cmdline Aqua.x86_64.elf File opened for reading /proc/118/cmdline Aqua.x86_64.elf File opened for reading /proc/767/cmdline Aqua.x86_64.elf File opened for reading /proc/1030/cmdline Aqua.x86_64.elf File opened for reading /proc/1169/cmdline Aqua.x86_64.elf File opened for reading /proc/1175/cmdline Aqua.x86_64.elf File opened for reading /proc/77/cmdline Aqua.x86_64.elf File opened for reading /proc/217/cmdline Aqua.x86_64.elf File opened for reading /proc/695/cmdline Aqua.x86_64.elf File opened for reading /proc/759/cmdline Aqua.x86_64.elf File opened for reading /proc/588/cmdline Aqua.x86_64.elf File opened for reading /proc/7/cmdline Aqua.x86_64.elf File opened for reading /proc/16/cmdline Aqua.x86_64.elf File opened for reading /proc/24/cmdline Aqua.x86_64.elf File opened for reading /proc/109/cmdline Aqua.x86_64.elf File opened for reading /proc/222/cmdline Aqua.x86_64.elf File opened for reading /proc/308/cmdline Aqua.x86_64.elf File opened for reading /proc/409/cmdline Aqua.x86_64.elf File opened for reading /proc/988/cmdline Aqua.x86_64.elf File opened for reading /proc/1069/cmdline Aqua.x86_64.elf File opened for reading /proc/1142/cmdline Aqua.x86_64.elf File opened for reading /proc/4/cmdline Aqua.x86_64.elf File opened for reading /proc/600/cmdline Aqua.x86_64.elf File opened for reading /proc/88/cmdline Aqua.x86_64.elf File opened for reading /proc/405/cmdline Aqua.x86_64.elf File opened for reading /proc/410/cmdline Aqua.x86_64.elf File opened for reading /proc/678/cmdline Aqua.x86_64.elf File opened for reading /proc/772/cmdline Aqua.x86_64.elf File opened for reading /proc/780/cmdline Aqua.x86_64.elf File opened for reading /proc/833/cmdline Aqua.x86_64.elf File opened for reading /proc/18/cmdline Aqua.x86_64.elf File opened for reading /proc/86/cmdline Aqua.x86_64.elf File opened for reading /proc/98/cmdline Aqua.x86_64.elf File opened for reading /proc/631/cmdline Aqua.x86_64.elf File opened for reading /proc/1059/cmdline Aqua.x86_64.elf File opened for reading /proc/1071/cmdline Aqua.x86_64.elf File opened for reading /proc/93/cmdline Aqua.x86_64.elf File opened for reading /proc/838/cmdline Aqua.x86_64.elf File opened for reading /proc/13/cmdline Aqua.x86_64.elf File opened for reading /proc/94/cmdline Aqua.x86_64.elf File opened for reading /proc/99/cmdline Aqua.x86_64.elf File opened for reading /proc/97/cmdline Aqua.x86_64.elf File opened for reading /proc/209/cmdline Aqua.x86_64.elf File opened for reading /proc/634/cmdline Aqua.x86_64.elf File opened for reading /proc/1158/cmdline Aqua.x86_64.elf File opened for reading /proc/15/cmdline Aqua.x86_64.elf File opened for reading /proc/25/cmdline Aqua.x86_64.elf File opened for reading /proc/112/cmdline Aqua.x86_64.elf File opened for reading /proc/220/cmdline Aqua.x86_64.elf File opened for reading /proc/527/cmdline Aqua.x86_64.elf File opened for reading /proc/650/cmdline Aqua.x86_64.elf File opened for reading /proc/987/cmdline Aqua.x86_64.elf File opened for reading /proc/83/cmdline Aqua.x86_64.elf