Analysis
-
max time kernel
149s -
max time network
159s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
29-12-2024 02:12
Behavioral task
behavioral1
Sample
Aqua.arm7.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
Aqua.arm7.elf
-
Size
201KB
-
MD5
4f6b53a48b82f792805e56eebb15fdc0
-
SHA1
9e08e555d873ff23bc407642ee75d682004c24ec
-
SHA256
76fc65942be706316258c0175e70bc63378cb1d08863118848ec753bea906c7e
-
SHA512
9a296ee95cf7cb397c71ab62bb365a8a88c8e0ae092e6937c73f7b48a0c1149bcf7be0ad34171a6ed567eef2680a2955e1a91f4e9d157bda97637dd78af0a7ff
-
SSDEEP
6144:Rdq+j3uigacvucaDxoWCZGq8kvVpM+uxGM/RzMIP:R/j3u2aucadoWCZHP9p2xf/uIP
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 667 Aqua.arm7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 666 Aqua.arm7.elf -
description ioc Process File opened for reading /proc/6666�:/stat Aqua.arm7.elf File opened for reading /proc/6666f;/stat Aqua.arm7.elf File opened for reading /proc/6666�;/stat Aqua.arm7.elf File opened for reading /proc/3333�,/stat Aqua.arm7.elf File opened for reading /proc/7777�7/cmdline Aqua.arm7.elf File opened for reading /proc/7777d9/stat Aqua.arm7.elf File opened for reading /proc/33/cmdline Aqua.arm7.elf File opened for reading /proc/444/cmdline Aqua.arm7.elf File opened for reading /proc/6666�5/cmdline Aqua.arm7.elf File opened for reading /proc/33/stat Aqua.arm7.elf File opened for reading /proc/222�"/stat Aqua.arm7.elf File opened for reading /proc/6666]:/stat Aqua.arm7.elf File opened for reading /proc/88881/stat Aqua.arm7.elf File opened for reading /proc/6666n6/stat Aqua.arm7.elf File opened for reading /proc/7777h8/stat Aqua.arm7.elf File opened for reading /proc/6666�9/cmdline Aqua.arm7.elf File opened for reading /proc/99ll�"/cmdline Aqua.arm7.elf File opened for reading /proc/222s�"/stat Aqua.arm7.elf File opened for reading /proc/88/stat Aqua.arm7.elf File opened for reading /proc/22/cmdline Aqua.arm7.elf File opened for reading /proc/6666�4/stat Aqua.arm7.elf File opened for reading /proc/7777z6/cmdline Aqua.arm7.elf File opened for reading /proc/6666W:/cmdline Aqua.arm7.elf File opened for reading /proc/6666W:/stat Aqua.arm7.elf File opened for reading /proc/1111�-/cmdline Aqua.arm7.elf File opened for reading /proc/222l�"/stat Aqua.arm7.elf File opened for reading /proc/7777�6/stat Aqua.arm7.elf File opened for reading /proc/7777y7/cmdline Aqua.arm7.elf File opened for reading /proc/6666�8/stat Aqua.arm7.elf File opened for reading /proc/6666�6/cmdline Aqua.arm7.elf File opened for reading /proc/222v�"/cmdline Aqua.arm7.elf File opened for reading /proc/777s�"/cmdline Aqua.arm7.elf File opened for reading /proc/111c�"/stat Aqua.arm7.elf File opened for reading /proc/3333�/stat Aqua.arm7.elf File opened for reading /proc/6666�5/stat Aqua.arm7.elf File opened for reading /proc/7777�6/stat Aqua.arm7.elf File opened for reading /proc/66/cmdline Aqua.arm7.elf File opened for reading /proc/1111 $/cmdline Aqua.arm7.elf File opened for reading /proc/6666�5/cmdline Aqua.arm7.elf File opened for reading /proc/66666/stat Aqua.arm7.elf File opened for reading /proc/6666�6/stat Aqua.arm7.elf File opened for reading /proc/7777{7/cmdline Aqua.arm7.elf File opened for reading /proc/6666�:/cmdline Aqua.arm7.elf File opened for reading /proc/111�"/cmdline Aqua.arm7.elf File opened for reading /proc/66666/cmdline Aqua.arm7.elf File opened for reading /proc/66666/cmdline Aqua.arm7.elf File opened for reading /proc/222�"/cmdline Aqua.arm7.elf File opened for reading /proc/111�"/stat Aqua.arm7.elf File opened for reading /proc/1111�-/stat Aqua.arm7.elf File opened for reading /proc/6666�5/cmdline Aqua.arm7.elf File opened for reading /proc/6666�5/stat Aqua.arm7.elf File opened for reading /proc/7777�7/cmdline Aqua.arm7.elf File opened for reading /proc/222i�"/cmdline Aqua.arm7.elf File opened for reading /proc/6666�4/cmdline Aqua.arm7.elf File opened for reading /proc/6666�5/cmdline Aqua.arm7.elf File opened for reading /proc/1111�-/stat Aqua.arm7.elf File opened for reading /proc/44/cmdline Aqua.arm7.elf File opened for reading /proc/222v�"/cmdline Aqua.arm7.elf File opened for reading /proc/2222>+/cmdline Aqua.arm7.elf File opened for reading /proc/3333�-/cmdline Aqua.arm7.elf File opened for reading /proc/4444�5/cmdline Aqua.arm7.elf File opened for reading /proc/1111 )/stat Aqua.arm7.elf File opened for reading /proc/77776/cmdline Aqua.arm7.elf File opened for reading /proc/6666�6/stat Aqua.arm7.elf