Overview
overview
10Static
static
10250103/Aqua.arm4
debian-12-armhf
1250103/Aqua.arm5
debian-9-armhf
7250103/Aqua.arm6
debian-9-armhf
1250103/Aqua.arm7
debian-12-armhf
7250103/Aqua.i686
ubuntu-22.04-amd64
7250103/Aqua.m68k
ubuntu-18.04-amd64
250103/Aqua.m68k
debian-9-armhf
250103/Aqua.m68k
debian-9-mips
250103/Aqua.m68k
debian-9-mipsel
250103/Aqua.mips
debian-9-mips
7250103/Aqua.mips.1
debian-9-mips
7250103/Aqua.mpsl
debian-12-mipsel
250103/Aqua.ppc
ubuntu-18.04-amd64
250103/Aqua.ppc
debian-9-armhf
250103/Aqua.ppc
debian-9-mips
250103/Aqua.ppc
debian-9-mipsel
250103/Aqua.sh4
ubuntu-18.04-amd64
250103/Aqua.sh4
debian-9-armhf
250103/Aqua.sh4
debian-9-mips
250103/Aqua.sh4
debian-9-mipsel
250103/Aqua.x86
ubuntu-20.04-amd64
7250103/Aqua.x86_64
ubuntu-22.04-amd64
7250103/random.sh
windows7-x64
3250103/random.sh
windows10-2004-x64
3250103/rmod.sh
windows7-x64
3250103/rmod.sh
windows10-2004-x64
3Analysis
-
max time kernel
130s -
max time network
147s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20241127-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20241127-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
02-01-2025 23:56
Behavioral task
behavioral1
Sample
250103/Aqua.arm4
Resource
debian12-armhf-20240221-en
debian-12-armhf
Behavioral task
behavioral2
Sample
250103/Aqua.arm5
Resource
debian9-armhf-20240418-en
debian-9-armhf
Behavioral task
behavioral3
Sample
250103/Aqua.arm6
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral4
Sample
250103/Aqua.arm7
Resource
debian12-armhf-20240418-en
debian-12-armhf
Behavioral task
behavioral5
Sample
250103/Aqua.i686
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral6
Sample
250103/Aqua.m68k
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral7
Sample
250103/Aqua.m68k
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral8
Sample
250103/Aqua.m68k
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral9
Sample
250103/Aqua.m68k
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
Behavioral task
behavioral10
Sample
250103/Aqua.mips
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral11
Sample
250103/Aqua.mips.1
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral12
Sample
250103/Aqua.mpsl
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
Behavioral task
behavioral13
Sample
250103/Aqua.ppc
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral14
Sample
250103/Aqua.ppc
Resource
debian9-armhf-20240418-en
debian-9-armhf
Behavioral task
behavioral15
Sample
250103/Aqua.ppc
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral16
Sample
250103/Aqua.ppc
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
Behavioral task
behavioral17
Sample
250103/Aqua.sh4
Resource
ubuntu1804-amd64-20240729-en
ubuntu-18.04-amd64
Behavioral task
behavioral18
Sample
250103/Aqua.sh4
Resource
debian9-armhf-20240418-en
debian-9-armhf
Behavioral task
behavioral19
Sample
250103/Aqua.sh4
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral20
Sample
250103/Aqua.sh4
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral21
Sample
250103/Aqua.x86
Resource
ubuntu2004-amd64-20241127-en
ubuntu-20.04-amd64
Behavioral task
behavioral22
Sample
250103/Aqua.x86_64
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral23
Sample
250103/random.sh
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral24
Sample
250103/random.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
250103/rmod.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
250103/rmod.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
250103/Aqua.x86
-
Size
61KB
-
MD5
785339a085925778d164e6048a5db5db
-
SHA1
d5a458fda72b4e38a12d07631c198414510e9e78
-
SHA256
25d8cb0ef26bd4c82292428f59fddd9378e664da42eb027a209b30db6ec857bf
-
SHA512
5186f196d8633a7343df1b8104cc1aadc804bb8965869cc7d24ab929ea86635e32fee72b0789c1760236925dc074dae458448eb928a2aababe39b6c25d0e2466
-
SSDEEP
1536:hsJzVTBEV6t+sJ9b6Vc53mqmXyyIjcA3B969X81OwIO73:uJBVEV6tZ2c9mqmXy3jlBaM1D
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1401 Aqua.x86 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 1400 Aqua.x86 -
description ioc Process File opened for reading /proc/165/cmdline Aqua.x86 File opened for reading /proc/269/cmdline Aqua.x86 File opened for reading /proc/961/cmdline Aqua.x86 File opened for reading /proc/90/cmdline Aqua.x86 File opened for reading /proc/92/cmdline Aqua.x86 File opened for reading /proc/102/cmdline Aqua.x86 File opened for reading /proc/130/cmdline Aqua.x86 File opened for reading /proc/162/cmdline Aqua.x86 File opened for reading /proc/447/cmdline Aqua.x86 File opened for reading /proc/903/cmdline Aqua.x86 File opened for reading /proc/8/cmdline Aqua.x86 File opened for reading /proc/73/cmdline Aqua.x86 File opened for reading /proc/119/cmdline Aqua.x86 File opened for reading /proc/111/cmdline Aqua.x86 File opened for reading /proc/88/cmdline Aqua.x86 File opened for reading /proc/160/cmdline Aqua.x86 File opened for reading /proc/176/cmdline Aqua.x86 File opened for reading /proc/993/cmdline Aqua.x86 File opened for reading /proc/1081/cmdline Aqua.x86 File opened for reading /proc/9/cmdline Aqua.x86 File opened for reading /proc/76/cmdline Aqua.x86 File opened for reading /proc/85/cmdline Aqua.x86 File opened for reading /proc/530/cmdline Aqua.x86 File opened for reading /proc/683/cmdline Aqua.x86 File opened for reading /proc/3/cmdline Aqua.x86 File opened for reading /proc/4/cmdline Aqua.x86 File opened for reading /proc/70/cmdline Aqua.x86 File opened for reading /proc/886/cmdline Aqua.x86 File opened for reading /proc/950/cmdline Aqua.x86 File opened for reading /proc/89/cmdline Aqua.x86 File opened for reading /proc/470/cmdline Aqua.x86 File opened for reading /proc/631/cmdline Aqua.x86 File opened for reading /proc/172/cmdline Aqua.x86 File opened for reading /proc/455/cmdline Aqua.x86 File opened for reading /proc/769/cmdline Aqua.x86 File opened for reading /proc/786/cmdline Aqua.x86 File opened for reading /proc/829/cmdline Aqua.x86 File opened for reading /proc/863/cmdline Aqua.x86 File opened for reading /proc/20/cmdline Aqua.x86 File opened for reading /proc/177/cmdline Aqua.x86 File opened for reading /proc/201/cmdline Aqua.x86 File opened for reading /proc/1008/cmdline Aqua.x86 File opened for reading /proc/1094/cmdline Aqua.x86 File opened for reading /proc/501/cmdline Aqua.x86 File opened for reading /proc/7/cmdline Aqua.x86 File opened for reading /proc/159/cmdline Aqua.x86 File opened for reading /proc/242/cmdline Aqua.x86 File opened for reading /proc/632/cmdline Aqua.x86 File opened for reading /proc/1031/cmdline Aqua.x86 File opened for reading /proc/18/cmdline Aqua.x86 File opened for reading /proc/173/cmdline Aqua.x86 File opened for reading /proc/491/cmdline Aqua.x86 File opened for reading /proc/163/cmdline Aqua.x86 File opened for reading /proc/496/cmdline Aqua.x86 File opened for reading /proc/968/cmdline Aqua.x86 File opened for reading /proc/22/cmdline Aqua.x86 File opened for reading /proc/72/cmdline Aqua.x86 File opened for reading /proc/91/cmdline Aqua.x86 File opened for reading /proc/441/cmdline Aqua.x86 File opened for reading /proc/513/cmdline Aqua.x86 File opened for reading /proc/559/cmdline Aqua.x86 File opened for reading /proc/567/cmdline Aqua.x86 File opened for reading /proc/1040/cmdline Aqua.x86 File opened for reading /proc/14/cmdline Aqua.x86