Analysis
-
max time kernel
149s -
max time network
142s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
29-12-2024 00:07
Behavioral task
behavioral1
Sample
Aqua.arm7.elf
Resource
debian9-armhf-20240418-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
Aqua.arm7.elf
-
Size
153KB
-
MD5
8c9168d0015512b1f0252e7499416b30
-
SHA1
9b1e02298ea414bfefbd97c00b7053ed15c33a66
-
SHA256
b41e29e745b69f3e8c11d105e7e050fd9e08ff1e22efd97fd4c239a9095d708b
-
SHA512
d44c06e12c261d463db1f100ef573bebd14f93efe51064cd5a4e25d77cc676f76d47d3685d10632606d47bf345c9eb53233698e44ceb104a65ab561cf62608a0
-
SSDEEP
3072:30MUdehIVNTkaGGiuM1BB6+5rhW+cqTMa/mCGM/9zODF9z+:30MUMhWdkaGGiuM1D6gWdWMa/mrM/9GK
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 640 Aqua.arm7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 639 Aqua.arm7.elf -
description ioc Process File opened for reading /proc/2222e*/stat Aqua.arm7.elf File opened for reading /proc/66666/cmdline Aqua.arm7.elf File opened for reading /proc/7777T5/cmdline Aqua.arm7.elf File opened for reading /proc/7777C6/stat Aqua.arm7.elf File opened for reading /proc/777718/cmdline Aqua.arm7.elf File opened for reading /proc/222i�"/cmdline Aqua.arm7.elf File opened for reading /proc/1111�3/cmdline Aqua.arm7.elf File opened for reading /proc/5555l/cmdline Aqua.arm7.elf File opened for reading /proc/44/stat Aqua.arm7.elf File opened for reading /proc/666664/cmdline Aqua.arm7.elf File opened for reading /proc/77772/stat Aqua.arm7.elf File opened for reading /proc/7777�7/cmdline Aqua.arm7.elf File opened for reading /proc/1111�3/cmdline Aqua.arm7.elf File opened for reading /proc/1111�%/cmdline Aqua.arm7.elf File opened for reading /proc/6666�3/cmdline Aqua.arm7.elf File opened for reading /proc/77776/cmdline Aqua.arm7.elf File opened for reading /proc/777718/stat Aqua.arm7.elf File opened for reading /proc/22/stat Aqua.arm7.elf File opened for reading /proc/3333/stat Aqua.arm7.elf File opened for reading /proc/6666�4/cmdline Aqua.arm7.elf File opened for reading /proc/999�"/cmdline Aqua.arm7.elf File opened for reading /proc/6666�3/cmdline Aqua.arm7.elf File opened for reading /proc/6666�4/stat Aqua.arm7.elf File opened for reading /proc/77773/stat Aqua.arm7.elf File opened for reading /proc/6666�3/stat Aqua.arm7.elf File opened for reading /proc/66664/cmdline Aqua.arm7.elf File opened for reading /proc/6666�3/stat Aqua.arm7.elf File opened for reading /proc/6666�3/stat Aqua.arm7.elf File opened for reading /proc/6666Z4/stat Aqua.arm7.elf File opened for reading /proc/7777L6/cmdline Aqua.arm7.elf File opened for reading /proc/77773/cmdline Aqua.arm7.elf File opened for reading /proc/222�"/cmdline Aqua.arm7.elf File opened for reading /proc/1111�3/stat Aqua.arm7.elf File opened for reading /proc/5555 3/stat Aqua.arm7.elf File opened for reading /proc/6666{4/stat Aqua.arm7.elf File opened for reading /proc/7777�6/stat Aqua.arm7.elf File opened for reading /proc/7777�8/cmdline Aqua.arm7.elf File opened for reading /proc/1111�3/stat Aqua.arm7.elf File opened for reading /proc/66665/stat Aqua.arm7.elf File opened for reading /proc/7777z5/cmdline Aqua.arm7.elf File opened for reading /proc/7777�5/cmdline Aqua.arm7.elf File opened for reading /proc/6666Z4/cmdline Aqua.arm7.elf File opened for reading /proc/7777/5/stat Aqua.arm7.elf File opened for reading /proc/7777;9/cmdline Aqua.arm7.elf File opened for reading /proc/88ll�"/stat Aqua.arm7.elf File opened for reading /proc/7777�5/cmdline Aqua.arm7.elf File opened for reading /proc/77777/stat Aqua.arm7.elf File opened for reading /proc/6666V3/stat Aqua.arm7.elf File opened for reading /proc/66667/cmdline Aqua.arm7.elf File opened for reading /proc/6666X4/cmdline Aqua.arm7.elf File opened for reading /proc/7777(7/cmdline Aqua.arm7.elf File opened for reading /proc/111�"/cmdline Aqua.arm7.elf File opened for reading /proc/5555�2/cmdline Aqua.arm7.elf File opened for reading /proc/6666�4/stat Aqua.arm7.elf File opened for reading /proc/5555�3/stat Aqua.arm7.elf File opened for reading /proc/7777�6/cmdline Aqua.arm7.elf File opened for reading /proc/7777t8/stat Aqua.arm7.elf File opened for reading /proc/2222�*/stat Aqua.arm7.elf File opened for reading /proc/5555�/stat Aqua.arm7.elf File opened for reading /proc/7777d7/cmdline Aqua.arm7.elf File opened for reading /proc/11/cmdline Aqua.arm7.elf File opened for reading /proc/5555�/cmdline Aqua.arm7.elf File opened for reading /proc/55550/cmdline Aqua.arm7.elf File opened for reading /proc/66/stat Aqua.arm7.elf