Analysis
-
max time kernel
106s -
max time network
151s -
platform
debian-9_mipsel -
resource
debian9-mipsel-20240611-en -
resource tags
arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem -
submitted
02-01-2025 14:27
Behavioral task
behavioral1
Sample
Aqua.mpsl.elf
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
5 signatures
150 seconds
General
-
Target
Aqua.mpsl.elf
-
Size
99KB
-
MD5
7bb031dae70313f86cea566e1f9befb8
-
SHA1
df961a253539710d0536f4d71ab99e427182652d
-
SHA256
870cdb772ccaccbec226b36358940b116d95502bad2b55d2b4fb52478dd27cec
-
SHA512
01986c08f0c6e87017086355d8589dfba08a47b59af37de6b9655a924973a402133bf17c4ccb7229e4e8a5484f69c02c21d1d108f3c6f28429f837c0dc2adbdc
-
SSDEEP
1536:jHUYxWHuWXEtOs23Mq4WEqMRsiCzZXTvgstW4CZJqewYVn2GJXTAYWg2GSio:j0YxWHqyyaFXTvDHCxrt1Y
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 699 Aqua.mpsl.elf -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 206.212.246.58 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 698 Aqua.mpsl.elf -
description ioc Process File opened for reading /proc/73/cmdline Aqua.mpsl.elf File opened for reading /proc/5/cmdline Aqua.mpsl.elf File opened for reading /proc/19/cmdline Aqua.mpsl.elf File opened for reading /proc/22/cmdline Aqua.mpsl.elf File opened for reading /proc/23/cmdline Aqua.mpsl.elf File opened for reading /proc/311/cmdline Aqua.mpsl.elf File opened for reading /proc/332/cmdline Aqua.mpsl.elf File opened for reading /proc/471/cmdline Aqua.mpsl.elf File opened for reading /proc/334/cmdline Aqua.mpsl.elf File opened for reading /proc/364/cmdline Aqua.mpsl.elf File opened for reading /proc/664/cmdline Aqua.mpsl.elf File opened for reading /proc/17/cmdline Aqua.mpsl.elf File opened for reading /proc/21/cmdline Aqua.mpsl.elf File opened for reading /proc/77/cmdline Aqua.mpsl.elf File opened for reading /proc/115/cmdline Aqua.mpsl.elf File opened for reading /proc/7/cmdline Aqua.mpsl.elf File opened for reading /proc/13/cmdline Aqua.mpsl.elf File opened for reading /proc/12/cmdline Aqua.mpsl.elf File opened for reading /proc/15/cmdline Aqua.mpsl.elf File opened for reading /proc/164/cmdline Aqua.mpsl.elf File opened for reading /proc/331/cmdline Aqua.mpsl.elf File opened for reading /proc/8/cmdline Aqua.mpsl.elf File opened for reading /proc/20/cmdline Aqua.mpsl.elf File opened for reading /proc/82/cmdline Aqua.mpsl.elf File opened for reading /proc/336/cmdline Aqua.mpsl.elf File opened for reading /proc/226/cmdline Aqua.mpsl.elf File opened for reading /proc/9/cmdline Aqua.mpsl.elf File opened for reading /proc/76/cmdline Aqua.mpsl.elf File opened for reading /proc/78/cmdline Aqua.mpsl.elf File opened for reading /proc/116/cmdline Aqua.mpsl.elf File opened for reading /proc/661/cmdline Aqua.mpsl.elf File opened for reading /proc/10/cmdline Aqua.mpsl.elf File opened for reading /proc/14/cmdline Aqua.mpsl.elf File opened for reading /proc/36/cmdline Aqua.mpsl.elf File opened for reading /proc/70/cmdline Aqua.mpsl.elf File opened for reading /proc/2/cmdline Aqua.mpsl.elf File opened for reading /proc/3/cmdline Aqua.mpsl.elf File opened for reading /proc/378/cmdline Aqua.mpsl.elf File opened for reading /proc/11/cmdline Aqua.mpsl.elf File opened for reading /proc/16/cmdline Aqua.mpsl.elf File opened for reading /proc/4/cmdline Aqua.mpsl.elf File opened for reading /proc/81/cmdline Aqua.mpsl.elf File opened for reading /proc/149/cmdline Aqua.mpsl.elf File opened for reading /proc/669/cmdline Aqua.mpsl.elf File opened for reading /proc/72/cmdline Aqua.mpsl.elf File opened for reading /proc/74/cmdline Aqua.mpsl.elf File opened for reading /proc/75/cmdline Aqua.mpsl.elf File opened for reading /proc/366/cmdline Aqua.mpsl.elf File opened for reading /proc/24/cmdline Aqua.mpsl.elf File opened for reading /proc/71/cmdline Aqua.mpsl.elf File opened for reading /proc/84/cmdline Aqua.mpsl.elf File opened for reading /proc/106/cmdline Aqua.mpsl.elf File opened for reading /proc/146/cmdline Aqua.mpsl.elf File opened for reading /proc/330/cmdline Aqua.mpsl.elf File opened for reading /proc/6/cmdline Aqua.mpsl.elf File opened for reading /proc/18/cmdline Aqua.mpsl.elf File opened for reading /proc/37/cmdline Aqua.mpsl.elf