Analysis
-
max time kernel
149s -
max time network
152s -
platform
debian-12_armhf -
resource
debian12-armhf-20240729-en -
resource tags
arch:armhfimage:debian12-armhf-20240729-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
29-12-2024 15:22
Behavioral task
behavioral1
Sample
Aqua.arm7.elf
Resource
debian12-armhf-20240729-en
debian-12-armhf
3 signatures
150 seconds
General
-
Target
Aqua.arm7.elf
-
Size
153KB
-
MD5
20929309199e4b8bbca4899ac02edd16
-
SHA1
f47314762d0084b305a4147e3224b66380131a10
-
SHA256
f4dbb2787ac86f3323d5aa0d60db73b3630c212ec8b422768e92fd449e535049
-
SHA512
3bbf566b0545f22bcd2c7bf87c685891d3c2369d14e0e6ea90a8559b778b8197e358aaa64b46e0cff4714810f5cea71d21e2da0c8f249de6cffdf97dffd79caf
-
SSDEEP
3072:30MUdehIVNTkaGGiuM1BB6+5rhW+cq/Ma/mCGM/9zODF9z+:30MUMhWdkaGGiuM1D6gWdGMa/mrM/9GK
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 710 Aqua.arm7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 708 Aqua.arm7.elf -
description ioc Process File opened for reading /proc/111up/cmdline Aqua.arm7.elf File opened for reading /proc/333s�/stat Aqua.arm7.elf File opened for reading /proc/6666-;/stat Aqua.arm7.elf File opened for reading /proc/7777];/stat Aqua.arm7.elf File opened for reading /proc/333s�/cmdline Aqua.arm7.elf File opened for reading /proc/3333B5/cmdline Aqua.arm7.elf File opened for reading /proc/55/stat Aqua.arm7.elf File opened for reading /proc/2222#4/stat Aqua.arm7.elf File opened for reading /proc/7777];/cmdline Aqua.arm7.elf File opened for reading /proc/3333�4/stat Aqua.arm7.elf File opened for reading /proc/7777C;/stat Aqua.arm7.elf File opened for reading /proc/55/cmdline Aqua.arm7.elf File opened for reading /proc/222c�/cmdline Aqua.arm7.elf File opened for reading /proc/333s�/cmdline Aqua.arm7.elf File opened for reading /proc/2222�3/cmdline Aqua.arm7.elf File opened for reading /proc/444d�/stat Aqua.arm7.elf File opened for reading /proc/1111S0/cmdline Aqua.arm7.elf File opened for reading /proc/6666�:/cmdline Aqua.arm7.elf File opened for reading /proc/111cx/stat Aqua.arm7.elf File opened for reading /proc/111cz/stat Aqua.arm7.elf File opened for reading /proc/6666�:/stat Aqua.arm7.elf File opened for reading /proc/88/cmdline Aqua.arm7.elf File opened for reading /proc/1111X2/cmdline Aqua.arm7.elf File opened for reading /proc/3333�4/cmdline Aqua.arm7.elf File opened for reading /proc/7777/cmdline Aqua.arm7.elf File opened for reading /proc/44/stat Aqua.arm7.elf File opened for reading /proc/7777H;/stat Aqua.arm7.elf File opened for reading /proc/7777[;/stat Aqua.arm7.elf File opened for reading /proc/7777;/cmdline Aqua.arm7.elf File opened for reading /proc/1111#;/stat Aqua.arm7.elf File opened for reading /proc/1111X2/stat Aqua.arm7.elf File opened for reading /proc/7777l;/cmdline Aqua.arm7.elf File opened for reading /proc/7777e;/stat Aqua.arm7.elf File opened for reading /proc/444/cmdline Aqua.arm7.elf File opened for reading /proc/6666-;/cmdline Aqua.arm7.elf File opened for reading /proc/555s�/stat Aqua.arm7.elf File opened for reading /proc/1111S0/stat Aqua.arm7.elf File opened for reading /proc/7777e;/cmdline Aqua.arm7.elf File opened for reading /proc/333�/cmdline Aqua.arm7.elf File opened for reading /proc/333/cmdline Aqua.arm7.elf File opened for reading /proc/222c�/stat Aqua.arm7.elf File opened for reading /proc/7777;/stat Aqua.arm7.elf File opened for reading /proc/7777Y;/cmdline Aqua.arm7.elf File opened for reading /proc/222/cmdline Aqua.arm7.elf File opened for reading /proc/99ssf/stat Aqua.arm7.elf File opened for reading /proc/6666.;/stat Aqua.arm7.elf File opened for reading /proc/77770;/stat Aqua.arm7.elf File opened for reading /proc/3333�4/cmdline Aqua.arm7.elf File opened for reading /proc/3333"5/cmdline Aqua.arm7.elf File opened for reading /proc/3333c5/stat Aqua.arm7.elf File opened for reading /proc/7777E;/stat Aqua.arm7.elf File opened for reading /proc/7777�;/stat Aqua.arm7.elf File opened for reading /proc/11/cmdline Aqua.arm7.elf File opened for reading /proc/66/cmdline Aqua.arm7.elf File opened for reading /proc/6666�:/stat Aqua.arm7.elf File opened for reading /proc/7777C;/cmdline Aqua.arm7.elf File opened for reading /proc/1111�/cmdline Aqua.arm7.elf File opened for reading /proc/222l�/stat Aqua.arm7.elf File opened for reading /proc/555/stat Aqua.arm7.elf File opened for reading /proc/22/cmdline Aqua.arm7.elf File opened for reading /proc/555/cmdline Aqua.arm7.elf File opened for reading /proc/333�/stat Aqua.arm7.elf File opened for reading /proc/7777d;/stat Aqua.arm7.elf File opened for reading /proc/1111";/cmdline Aqua.arm7.elf