Analysis
-
max time kernel
130s -
max time network
146s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
31-12-2024 13:22
Behavioral task
behavioral1
Sample
Aqua.arm7.elf
Resource
debian9-armhf-20240418-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
Aqua.arm7.elf
-
Size
154KB
-
MD5
fbee06479cd3d2908500f57089eaac44
-
SHA1
259fadf7e37ba06549d19a9784e43cceb81f0a92
-
SHA256
a99311671e21b6f242f06af6cc0e0ac4dea0d418a917e6cd7c74072755caadf3
-
SHA512
1ef52b6c9090af3a32f2b25c0b6ddade1729492b637b32824052754f35f53e32b3dae6ac165e23bc956248f0feca9cfbf60df26bfca224600c9068da28ee4363
-
SSDEEP
3072:of4fkx/LXeakFSesMI4oaZrS3FSO/DjEMmM/9kYXUz+:of4cx/7eakFSesMVoT3ESDjExM/9/Ua
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 646 Aqua.arm7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 645 Aqua.arm7.elf -
description ioc Process File opened for reading /proc/6666P4/cmdline Aqua.arm7.elf File opened for reading /proc/6666�4/cmdline Aqua.arm7.elf File opened for reading /proc/66667/cmdline Aqua.arm7.elf File opened for reading /proc/7777#6/stat Aqua.arm7.elf File opened for reading /proc/6666A8/cmdline Aqua.arm7.elf File opened for reading /proc/2222,/stat Aqua.arm7.elf File opened for reading /proc/6666G4/stat Aqua.arm7.elf File opened for reading /proc/6666�4/cmdline Aqua.arm7.elf File opened for reading /proc/7777�6/stat Aqua.arm7.elf File opened for reading /proc/66663/cmdline Aqua.arm7.elf File opened for reading /proc/6666�6/stat Aqua.arm7.elf File opened for reading /proc/6666y5/cmdline Aqua.arm7.elf File opened for reading /proc/77772/cmdline Aqua.arm7.elf File opened for reading /proc/111�"/cmdline Aqua.arm7.elf File opened for reading /proc/222�"/cmdline Aqua.arm7.elf File opened for reading /proc/1111�"/cmdline Aqua.arm7.elf File opened for reading /proc/222v�"/stat Aqua.arm7.elf File opened for reading /proc/66667/stat Aqua.arm7.elf File opened for reading /proc/66665/stat Aqua.arm7.elf File opened for reading /proc/77/cmdline Aqua.arm7.elf File opened for reading /proc/6666P4/stat Aqua.arm7.elf File opened for reading /proc/6666�4/cmdline Aqua.arm7.elf File opened for reading /proc/6666�4/cmdline Aqua.arm7.elf File opened for reading /proc/66666/cmdline Aqua.arm7.elf File opened for reading /proc/77775/cmdline Aqua.arm7.elf File opened for reading /proc/77776/cmdline Aqua.arm7.elf File opened for reading /proc/6666�7/stat Aqua.arm7.elf File opened for reading /proc/44/cmdline Aqua.arm7.elf File opened for reading /proc/666625/stat Aqua.arm7.elf File opened for reading /proc/6666�4/stat Aqua.arm7.elf File opened for reading /proc/7777#6/cmdline Aqua.arm7.elf File opened for reading /proc/7777�6/cmdline Aqua.arm7.elf File opened for reading /proc/66661/cmdline Aqua.arm7.elf File opened for reading /proc/6666A8/stat Aqua.arm7.elf File opened for reading /proc/111m�"/cmdline Aqua.arm7.elf File opened for reading /proc/6666V4/stat Aqua.arm7.elf File opened for reading /proc/6666�4/stat Aqua.arm7.elf File opened for reading /proc/6666>5/cmdline Aqua.arm7.elf File opened for reading /proc/7777n6/cmdline Aqua.arm7.elf File opened for reading /proc/6666�4/stat Aqua.arm7.elf File opened for reading /proc/6666}8/cmdline Aqua.arm7.elf File opened for reading /proc/6666N4/cmdline Aqua.arm7.elf File opened for reading /proc/77776/stat Aqua.arm7.elf File opened for reading /proc/7777n6/stat Aqua.arm7.elf File opened for reading /proc/7777�6/stat Aqua.arm7.elf File opened for reading /proc/2222",/cmdline Aqua.arm7.elf File opened for reading /proc/6666�4/cmdline Aqua.arm7.elf File opened for reading /proc/77776/stat Aqua.arm7.elf File opened for reading /proc/222v�"/cmdline Aqua.arm7.elf File opened for reading /proc/22222*/cmdline Aqua.arm7.elf File opened for reading /proc/5555�0/cmdline Aqua.arm7.elf File opened for reading /proc/1111�"/stat Aqua.arm7.elf File opened for reading /proc/6666L4/stat Aqua.arm7.elf File opened for reading /proc/6666N4/stat Aqua.arm7.elf File opened for reading /proc/6666�9/stat Aqua.arm7.elf File opened for reading /proc/222l�"/cmdline Aqua.arm7.elf File opened for reading /proc/6666�6/stat Aqua.arm7.elf File opened for reading /proc/77772/stat Aqua.arm7.elf File opened for reading /proc/111c�"/cmdline Aqua.arm7.elf File opened for reading /proc/222i�"/cmdline Aqua.arm7.elf File opened for reading /proc/77776/cmdline Aqua.arm7.elf File opened for reading /proc/6666y5/stat Aqua.arm7.elf File opened for reading /proc/7777 6/stat Aqua.arm7.elf File opened for reading /proc/7777�6/stat Aqua.arm7.elf