87f1ad61c3f9896c05477b1598f701f33ea9017b0691a19d6ac152b1c4cecf0d | Triage

Analysis

max time kernel
144s
max time network
157s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
25-12-2024 16:32

Sharing

Report Analysis Logs

General

Target

Aqua.arm7.elf
Size

134KB
MD5

707f6a09c63e7c2ea16645b991beece2
SHA1

9d84b9d10704c06098b4eaec5f96e34d4ba47635
SHA256

87f1ad61c3f9896c05477b1598f701f33ea9017b0691a19d6ac152b1c4cecf0d
SHA512

ae7dd55b580561bf3ddab5ecc970f3c1317a83f01b8018cd4a21e2007bef3bd6d31b9a569da8069772c0abcf5409cc1b93e0918553626bd5d0ec317ae339c97c
SSDEEP

3072:i23pdvy+BPavQj2KlhdEfNJtgX/zOz+M/9V83Lq3p:i23pA8PavQj2KBEqX/zjM/9V83LqZ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
707	Aqua.arm7.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	httpd	704	Aqua.arm7.elf

/tmp/Aqua.arm7.elf
/tmp/Aqua.arm7.elf
1⤵
- Deletes itself
- Changes its process name
PID:704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads