Overview
overview
10Static
static
10250103/Aqua.arm4
debian-12-armhf
1250103/Aqua.arm5
debian-9-armhf
7250103/Aqua.arm6
debian-9-armhf
1250103/Aqua.arm7
debian-12-armhf
7250103/Aqua.i686
ubuntu-22.04-amd64
7250103/Aqua.m68k
ubuntu-18.04-amd64
250103/Aqua.m68k
debian-9-armhf
250103/Aqua.m68k
debian-9-mips
250103/Aqua.m68k
debian-9-mipsel
250103/Aqua.mips
debian-9-mips
7250103/Aqua.mips.1
debian-9-mips
7250103/Aqua.mpsl
debian-12-mipsel
250103/Aqua.ppc
ubuntu-18.04-amd64
250103/Aqua.ppc
debian-9-armhf
250103/Aqua.ppc
debian-9-mips
250103/Aqua.ppc
debian-9-mipsel
250103/Aqua.sh4
ubuntu-18.04-amd64
250103/Aqua.sh4
debian-9-armhf
250103/Aqua.sh4
debian-9-mips
250103/Aqua.sh4
debian-9-mipsel
250103/Aqua.x86
ubuntu-20.04-amd64
7250103/Aqua.x86_64
ubuntu-22.04-amd64
7250103/random.sh
windows7-x64
3250103/random.sh
windows10-2004-x64
3250103/rmod.sh
windows7-x64
3250103/rmod.sh
windows10-2004-x64
3Analysis
-
max time kernel
131s -
max time network
145s -
platform
debian-9_mips -
resource
debian9-mipsbe-20240611-en -
resource tags
arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem -
submitted
02-01-2025 23:56
Behavioral task
behavioral1
Sample
250103/Aqua.arm4
Resource
debian12-armhf-20240221-en
debian-12-armhf
Behavioral task
behavioral2
Sample
250103/Aqua.arm5
Resource
debian9-armhf-20240418-en
debian-9-armhf
Behavioral task
behavioral3
Sample
250103/Aqua.arm6
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral4
Sample
250103/Aqua.arm7
Resource
debian12-armhf-20240418-en
debian-12-armhf
Behavioral task
behavioral5
Sample
250103/Aqua.i686
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral6
Sample
250103/Aqua.m68k
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral7
Sample
250103/Aqua.m68k
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral8
Sample
250103/Aqua.m68k
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral9
Sample
250103/Aqua.m68k
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
Behavioral task
behavioral10
Sample
250103/Aqua.mips
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral11
Sample
250103/Aqua.mips.1
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral12
Sample
250103/Aqua.mpsl
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
Behavioral task
behavioral13
Sample
250103/Aqua.ppc
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral14
Sample
250103/Aqua.ppc
Resource
debian9-armhf-20240418-en
debian-9-armhf
Behavioral task
behavioral15
Sample
250103/Aqua.ppc
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral16
Sample
250103/Aqua.ppc
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
Behavioral task
behavioral17
Sample
250103/Aqua.sh4
Resource
ubuntu1804-amd64-20240729-en
ubuntu-18.04-amd64
Behavioral task
behavioral18
Sample
250103/Aqua.sh4
Resource
debian9-armhf-20240418-en
debian-9-armhf
Behavioral task
behavioral19
Sample
250103/Aqua.sh4
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral20
Sample
250103/Aqua.sh4
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral21
Sample
250103/Aqua.x86
Resource
ubuntu2004-amd64-20241127-en
ubuntu-20.04-amd64
Behavioral task
behavioral22
Sample
250103/Aqua.x86_64
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral23
Sample
250103/random.sh
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral24
Sample
250103/random.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
250103/rmod.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
250103/rmod.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
250103/Aqua.mips
-
Size
99KB
-
MD5
b0cb7b6d60333527dbc0219c8a89007a
-
SHA1
a203f1026b8be2dcec10197733bf04ae1a29d97f
-
SHA256
d17bea13321535fbc4875edca84dfd6878dd09a4ecc7a57d4b41f1396d3ce3d8
-
SHA512
d4ed414c3a7122012245ae4d954930db679a8dca078c4f5e047969eeae9ae71fc6bd6d0c01761bc066ecb97a4f512d03c5fe54d58944aea691e5b02abe392a76
-
SSDEEP
1536:rzpIP811qxa0qw1KLIpPdB/o3T8e9m4//QSiWL7:JIP8HqvPdFo3TN/bL7
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 721 Aqua.mips -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 720 Aqua.mips -
description ioc Process File opened for reading /proc/22/cmdline Aqua.mips File opened for reading /proc/75/cmdline Aqua.mips File opened for reading /proc/110/cmdline Aqua.mips File opened for reading /proc/126/cmdline Aqua.mips File opened for reading /proc/7/cmdline Aqua.mips File opened for reading /proc/161/cmdline Aqua.mips File opened for reading /proc/433/cmdline Aqua.mips File opened for reading /proc/8/cmdline Aqua.mips File opened for reading /proc/12/cmdline Aqua.mips File opened for reading /proc/20/cmdline Aqua.mips File opened for reading /proc/36/cmdline Aqua.mips File opened for reading /proc/37/cmdline Aqua.mips File opened for reading /proc/71/cmdline Aqua.mips File opened for reading /proc/76/cmdline Aqua.mips File opened for reading /proc/10/cmdline Aqua.mips File opened for reading /proc/78/cmdline Aqua.mips File opened for reading /proc/678/cmdline Aqua.mips File opened for reading /proc/73/cmdline Aqua.mips File opened for reading /proc/244/cmdline Aqua.mips File opened for reading /proc/330/cmdline Aqua.mips File opened for reading /proc/81/cmdline Aqua.mips File opened for reading /proc/14/cmdline Aqua.mips File opened for reading /proc/17/cmdline Aqua.mips File opened for reading /proc/19/cmdline Aqua.mips File opened for reading /proc/21/cmdline Aqua.mips File opened for reading /proc/69/cmdline Aqua.mips File opened for reading /proc/335/cmdline Aqua.mips File opened for reading /proc/3/cmdline Aqua.mips File opened for reading /proc/6/cmdline Aqua.mips File opened for reading /proc/11/cmdline Aqua.mips File opened for reading /proc/24/cmdline Aqua.mips File opened for reading /proc/72/cmdline Aqua.mips File opened for reading /proc/82/cmdline Aqua.mips File opened for reading /proc/681/cmdline Aqua.mips File opened for reading /proc/4/cmdline Aqua.mips File opened for reading /proc/382/cmdline Aqua.mips File opened for reading /proc/331/cmdline Aqua.mips File opened for reading /proc/5/cmdline Aqua.mips File opened for reading /proc/176/cmdline Aqua.mips File opened for reading /proc/156/cmdline Aqua.mips File opened for reading /proc/18/cmdline Aqua.mips File opened for reading /proc/23/cmdline Aqua.mips File opened for reading /proc/674/cmdline Aqua.mips File opened for reading /proc/2/cmdline Aqua.mips File opened for reading /proc/16/cmdline Aqua.mips File opened for reading /proc/74/cmdline Aqua.mips File opened for reading /proc/384/cmdline Aqua.mips File opened for reading /proc/388/cmdline Aqua.mips File opened for reading /proc/13/cmdline Aqua.mips File opened for reading /proc/334/cmdline Aqua.mips File opened for reading /proc/389/cmdline Aqua.mips File opened for reading /proc/9/cmdline Aqua.mips File opened for reading /proc/70/cmdline Aqua.mips File opened for reading /proc/127/cmdline Aqua.mips File opened for reading /proc/364/cmdline Aqua.mips File opened for reading /proc/15/cmdline Aqua.mips -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 720 Aqua.mips