Analysis
-
max time kernel
149s -
max time network
146s -
platform
debian-12_armhf -
resource
debian12-armhf-20240418-en -
resource tags
arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
29-12-2024 00:11
Behavioral task
behavioral1
Sample
Aqua.arm7.elf
Resource
debian12-armhf-20240418-en
debian-12-armhf
3 signatures
150 seconds
General
-
Target
Aqua.arm7.elf
-
Size
153KB
-
MD5
8c9168d0015512b1f0252e7499416b30
-
SHA1
9b1e02298ea414bfefbd97c00b7053ed15c33a66
-
SHA256
b41e29e745b69f3e8c11d105e7e050fd9e08ff1e22efd97fd4c239a9095d708b
-
SHA512
d44c06e12c261d463db1f100ef573bebd14f93efe51064cd5a4e25d77cc676f76d47d3685d10632606d47bf345c9eb53233698e44ceb104a65ab561cf62608a0
-
SSDEEP
3072:30MUdehIVNTkaGGiuM1BB6+5rhW+cqTMa/mCGM/9zODF9z+:30MUMhWdkaGGiuM1D6gWdWMa/mrM/9GK
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 707 Aqua.arm7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 703 Aqua.arm7.elf -
description ioc Process File opened for reading /proc/7777�;/stat Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/777k�/cmdline Aqua.arm7.elf File opened for reading /proc/3333�4/stat Aqua.arm7.elf File opened for reading /proc/3333-5/stat Aqua.arm7.elf File opened for reading /proc/6666~;/stat Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/7777�;/stat Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/3333-5/cmdline Aqua.arm7.elf File opened for reading /proc/555/stat Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/22/cmdline Aqua.arm7.elf File opened for reading /proc/111c�/cmdline Aqua.arm7.elf File opened for reading /proc/3333 5/stat Aqua.arm7.elf File opened for reading /proc/6666�7/stat Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/6666�8/stat Aqua.arm7.elf File opened for reading /proc/6666 ;/stat Aqua.arm7.elf File opened for reading /proc/55/cmdline Aqua.arm7.elf File opened for reading /proc/77/cmdline Aqua.arm7.elf File opened for reading /proc/222l�/cmdline Aqua.arm7.elf File opened for reading /proc/222/stat Aqua.arm7.elf File opened for reading /proc/333�/stat Aqua.arm7.elf File opened for reading /proc/3333{;/stat Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/66/cmdline Aqua.arm7.elf File opened for reading /proc/222m�/cmdline Aqua.arm7.elf File opened for reading /proc/555s�/cmdline Aqua.arm7.elf File opened for reading /proc/6666 ;/cmdline Aqua.arm7.elf File opened for reading /proc/11/stat Aqua.arm7.elf File opened for reading /proc/44/stat Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/3333�4/cmdline Aqua.arm7.elf File opened for reading /proc/99sss/stat Aqua.arm7.elf File opened for reading /proc/333s�/stat Aqua.arm7.elf File opened for reading /proc/1111�/stat Aqua.arm7.elf File opened for reading /proc/6666�7/stat Aqua.arm7.elf File opened for reading /proc/7777/stat Aqua.arm7.elf File opened for reading /proc/333s�/cmdline Aqua.arm7.elf File opened for reading /proc/1111p;/cmdline Aqua.arm7.elf File opened for reading /proc/7777X;/cmdline Aqua.arm7.elf File opened for reading /proc/33/stat Aqua.arm7.elf File opened for reading /proc/222�/stat Aqua.arm7.elf File opened for reading /proc/444/cmdline Aqua.arm7.elf File opened for reading /proc/3333H5/cmdline Aqua.arm7.elf File opened for reading /proc/7777m;/stat Aqua.arm7.elf File opened for reading /proc/3333�4/cmdline Aqua.arm7.elf File opened for reading /proc/3333{;/cmdline Aqua.arm7.elf File opened for reading /proc/77/stat Aqua.arm7.elf File opened for reading /proc/2222E4/stat Aqua.arm7.elf File opened for reading /proc/7777�;/stat Aqua.arm7.elf File opened for reading /proc/111/cmdline Aqua.arm7.elf File opened for reading /proc/333/cmdline Aqua.arm7.elf File opened for reading /proc/2222�3/cmdline Aqua.arm7.elf File opened for reading /proc/3333Y5/cmdline Aqua.arm7.elf File opened for reading /proc/555s�/stat Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/6666�8/cmdline Aqua.arm7.elf File opened for reading /proc/2222r2/stat Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf