Overview
overview
10Static
static
10250103/Aqua.arm4
debian-12-armhf
1250103/Aqua.arm5
debian-9-armhf
7250103/Aqua.arm6
debian-9-armhf
1250103/Aqua.arm7
debian-12-armhf
7250103/Aqua.i686
ubuntu-22.04-amd64
7250103/Aqua.m68k
ubuntu-18.04-amd64
250103/Aqua.m68k
debian-9-armhf
250103/Aqua.m68k
debian-9-mips
250103/Aqua.m68k
debian-9-mipsel
250103/Aqua.mips
debian-9-mips
7250103/Aqua.mips.1
debian-9-mips
7250103/Aqua.mpsl
debian-12-mipsel
250103/Aqua.ppc
ubuntu-18.04-amd64
250103/Aqua.ppc
debian-9-armhf
250103/Aqua.ppc
debian-9-mips
250103/Aqua.ppc
debian-9-mipsel
250103/Aqua.sh4
ubuntu-18.04-amd64
250103/Aqua.sh4
debian-9-armhf
250103/Aqua.sh4
debian-9-mips
250103/Aqua.sh4
debian-9-mipsel
250103/Aqua.x86
ubuntu-20.04-amd64
7250103/Aqua.x86_64
ubuntu-22.04-amd64
7250103/random.sh
windows7-x64
3250103/random.sh
windows10-2004-x64
3250103/rmod.sh
windows7-x64
3250103/rmod.sh
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
147s -
platform
debian-12_armhf -
resource
debian12-armhf-20240418-en -
resource tags
arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
02-01-2025 23:56
Behavioral task
behavioral1
Sample
250103/Aqua.arm4
Resource
debian12-armhf-20240221-en
debian-12-armhf
Behavioral task
behavioral2
Sample
250103/Aqua.arm5
Resource
debian9-armhf-20240418-en
debian-9-armhf
Behavioral task
behavioral3
Sample
250103/Aqua.arm6
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral4
Sample
250103/Aqua.arm7
Resource
debian12-armhf-20240418-en
debian-12-armhf
Behavioral task
behavioral5
Sample
250103/Aqua.i686
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral6
Sample
250103/Aqua.m68k
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral7
Sample
250103/Aqua.m68k
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral8
Sample
250103/Aqua.m68k
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral9
Sample
250103/Aqua.m68k
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
Behavioral task
behavioral10
Sample
250103/Aqua.mips
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral11
Sample
250103/Aqua.mips.1
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral12
Sample
250103/Aqua.mpsl
Resource
debian12-mipsel-20240221-en
debian-12-mipsel
Behavioral task
behavioral13
Sample
250103/Aqua.ppc
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral14
Sample
250103/Aqua.ppc
Resource
debian9-armhf-20240418-en
debian-9-armhf
Behavioral task
behavioral15
Sample
250103/Aqua.ppc
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral16
Sample
250103/Aqua.ppc
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
Behavioral task
behavioral17
Sample
250103/Aqua.sh4
Resource
ubuntu1804-amd64-20240729-en
ubuntu-18.04-amd64
Behavioral task
behavioral18
Sample
250103/Aqua.sh4
Resource
debian9-armhf-20240418-en
debian-9-armhf
Behavioral task
behavioral19
Sample
250103/Aqua.sh4
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral20
Sample
250103/Aqua.sh4
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral21
Sample
250103/Aqua.x86
Resource
ubuntu2004-amd64-20241127-en
ubuntu-20.04-amd64
Behavioral task
behavioral22
Sample
250103/Aqua.x86_64
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral23
Sample
250103/random.sh
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral24
Sample
250103/random.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
250103/rmod.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
250103/rmod.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
250103/Aqua.arm7
-
Size
154KB
-
MD5
1021bcdbd3317439c8028eba6b621e08
-
SHA1
ef6f92fd8b9ce15c0af8ff379cedc6a8ffc85a36
-
SHA256
fc9ca464d8be8c202661ec5862c2b56b78f9cef824066d3dc32c3e58ee3a5f56
-
SHA512
168cd371ee931004406232b5692b1d3eacd53f211cb607eca5c3b0b1cba131c8328f5de74354e5fd1a062f926372497bdfb26de7cacff67b6ff78d317f14a08b
-
SSDEEP
3072:4f4fkx/LXeakFSesMI4oaZrS3FSO/DiEMmM/9nhJ+z+:4f4cx/7eakFSesMVoT3ESDiExM/93+a
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 730 Aqua.arm7 -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 726 Aqua.arm7 -
description ioc Process File opened for reading /proc/222�/cmdline Aqua.arm7 File opened for reading /proc/333/stat Aqua.arm7 File opened for reading /proc/7777)</stat Aqua.arm7 File opened for reading /proc/7777e</stat Aqua.arm7 File opened for reading /proc/7777�</stat Aqua.arm7 File opened for reading /proc/1111�/stat Aqua.arm7 File opened for reading /proc/6666�;/stat Aqua.arm7 File opened for reading /proc/11/stat Aqua.arm7 File opened for reading /proc/7777�;/cmdline Aqua.arm7 File opened for reading /proc/333s�/cmdline Aqua.arm7 File opened for reading /proc/3333�4/cmdline Aqua.arm7 File opened for reading /proc/3333fffffff/stat Aqua.arm7 File opened for reading /proc/7777�;/stat Aqua.arm7 File opened for reading /proc/222l�/cmdline Aqua.arm7 File opened for reading /proc/7777(</stat Aqua.arm7 File opened for reading /proc/7777 =/cmdline Aqua.arm7 File opened for reading /proc/6666�:/cmdline Aqua.arm7 File opened for reading /proc/3333u5/stat Aqua.arm7 File opened for reading /proc/7777�;/stat Aqua.arm7 File opened for reading /proc/7777�;/cmdline Aqua.arm7 File opened for reading /proc/7777=/cmdline Aqua.arm7 File opened for reading /proc/1111�2/cmdline Aqua.arm7 File opened for reading /proc/7777:</cmdline Aqua.arm7 File opened for reading /proc/222�/cmdline Aqua.arm7 File opened for reading /proc/444/stat Aqua.arm7 File opened for reading /proc/7777�</cmdline Aqua.arm7 File opened for reading /proc/7777�;/stat Aqua.arm7 File opened for reading /proc/7777%</cmdline Aqua.arm7 File opened for reading /proc/7777d</cmdline Aqua.arm7 File opened for reading /proc/7777�</cmdline Aqua.arm7 File opened for reading /proc/33335/stat Aqua.arm7 File opened for reading /proc/6666�8/stat Aqua.arm7 File opened for reading /proc/7777%</stat Aqua.arm7 File opened for reading /proc/7777�</cmdline Aqua.arm7 File opened for reading /proc/8888�</stat Aqua.arm7 File opened for reading /proc/222�/stat Aqua.arm7 File opened for reading /proc/7777�</stat Aqua.arm7 File opened for reading /proc/222�/stat Aqua.arm7 File opened for reading /proc/222l�/stat Aqua.arm7 File opened for reading /proc/7777 </cmdline Aqua.arm7 File opened for reading /proc/777k�/cmdline Aqua.arm7 File opened for reading /proc/7777�;/cmdline Aqua.arm7 File opened for reading /proc/7777</cmdline Aqua.arm7 File opened for reading /proc/6666�7/cmdline Aqua.arm7 File opened for reading /proc/444d�/stat Aqua.arm7 File opened for reading /proc/6666�;/stat Aqua.arm7 File opened for reading /proc/7777$</stat Aqua.arm7 File opened for reading /proc/7777)</cmdline Aqua.arm7 File opened for reading /proc/111c~/cmdline Aqua.arm7 File opened for reading /proc/7777�;/stat Aqua.arm7 File opened for reading /proc/8888�</cmdline Aqua.arm7 File opened for reading /proc/1111]0/cmdline Aqua.arm7 File opened for reading /proc/6666�8/cmdline Aqua.arm7 File opened for reading /proc/6666�;/cmdline Aqua.arm7 File opened for reading /proc/44/stat Aqua.arm7 File opened for reading /proc/111ut/stat Aqua.arm7 File opened for reading /proc/7777�;/cmdline Aqua.arm7 File opened for reading /proc/1111�;/cmdline Aqua.arm7 File opened for reading /proc/7777�;/cmdline Aqua.arm7 File opened for reading /proc/7777/stat Aqua.arm7 File opened for reading /proc/7777 </stat Aqua.arm7 File opened for reading /proc/2222�3/cmdline Aqua.arm7 File opened for reading /proc/3333�4/cmdline Aqua.arm7 File opened for reading /proc/7777�</stat Aqua.arm7