Analysis
-
max time kernel
149s -
max time network
143s -
platform
debian-9_armhf -
resource
debian9-armhf-20240418-en -
resource tags
arch:armhfimage:debian9-armhf-20240418-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
02/01/2025, 15:47
Behavioral task
behavioral1
Sample
Aqua.arm7.elf
Resource
debian9-armhf-20240418-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
Aqua.arm7.elf
-
Size
154KB
-
MD5
1021bcdbd3317439c8028eba6b621e08
-
SHA1
ef6f92fd8b9ce15c0af8ff379cedc6a8ffc85a36
-
SHA256
fc9ca464d8be8c202661ec5862c2b56b78f9cef824066d3dc32c3e58ee3a5f56
-
SHA512
168cd371ee931004406232b5692b1d3eacd53f211cb607eca5c3b0b1cba131c8328f5de74354e5fd1a062f926372497bdfb26de7cacff67b6ff78d317f14a08b
-
SSDEEP
3072:4f4fkx/LXeakFSesMI4oaZrS3FSO/DiEMmM/9nhJ+z+:4f4cx/7eakFSesMVoT3ESDiExM/93+a
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 662 Aqua.arm7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 660 Aqua.arm7.elf -
description ioc Process File opened for reading /proc/222�"/stat Aqua.arm7.elf File opened for reading /proc/777736/cmdline Aqua.arm7.elf File opened for reading /proc/77775/stat Aqua.arm7.elf File opened for reading /proc/222�"/cmdline Aqua.arm7.elf File opened for reading /proc/6666\4/stat Aqua.arm7.elf File opened for reading /proc/6666{5/cmdline Aqua.arm7.elf File opened for reading /proc/77775/cmdline Aqua.arm7.elf File opened for reading /proc/222v�"/cmdline Aqua.arm7.elf File opened for reading /proc/6666|5/cmdline Aqua.arm7.elf File opened for reading /proc/77776/stat Aqua.arm7.elf File opened for reading /proc/6666<6/cmdline Aqua.arm7.elf File opened for reading /proc/99/cmdline Aqua.arm7.elf File opened for reading /proc/1111�"/cmdline Aqua.arm7.elf File opened for reading /proc/6666W5/stat Aqua.arm7.elf File opened for reading /proc/6666�5/stat Aqua.arm7.elf File opened for reading /proc/6666�5/cmdline Aqua.arm7.elf File opened for reading /proc/44/cmdline Aqua.arm7.elf File opened for reading /proc/6666K5/cmdline Aqua.arm7.elf File opened for reading /proc/55/cmdline Aqua.arm7.elf File opened for reading /proc/222i�"/stat Aqua.arm7.elf File opened for reading /proc/1111�"/stat Aqua.arm7.elf File opened for reading /proc/66664/stat Aqua.arm7.elf File opened for reading /proc/6666m5/cmdline Aqua.arm7.elf File opened for reading /proc/6666�5/cmdline Aqua.arm7.elf File opened for reading /proc/7777�6/cmdline Aqua.arm7.elf File opened for reading /proc/7777?7/cmdline Aqua.arm7.elf File opened for reading /proc/66663/stat Aqua.arm7.elf File opened for reading /proc/777736/stat Aqua.arm7.elf File opened for reading /proc/6666�7/cmdline Aqua.arm7.elf File opened for reading /proc/6666�5/cmdline Aqua.arm7.elf File opened for reading /proc/7777�6/cmdline Aqua.arm7.elf File opened for reading /proc/7777L7/cmdline Aqua.arm7.elf File opened for reading /proc/77773/stat Aqua.arm7.elf File opened for reading /proc/6666�7/stat Aqua.arm7.elf File opened for reading /proc/6666�8/stat Aqua.arm7.elf File opened for reading /proc/444s�"/cmdline Aqua.arm7.elf File opened for reading /proc/444/stat Aqua.arm7.elf File opened for reading /proc/2222+/stat Aqua.arm7.elf File opened for reading /proc/66666/cmdline Aqua.arm7.elf File opened for reading /proc/7777d7/stat Aqua.arm7.elf File opened for reading /proc/6666A:/cmdline Aqua.arm7.elf File opened for reading /proc/6666�:/stat Aqua.arm7.elf File opened for reading /proc/3333Q-/stat Aqua.arm7.elf File opened for reading /proc/6666]5/stat Aqua.arm7.elf File opened for reading /proc/6666|5/stat Aqua.arm7.elf File opened for reading /proc/111�"/cmdline Aqua.arm7.elf File opened for reading /proc/3333�,/cmdline Aqua.arm7.elf File opened for reading /proc/3333�,/stat Aqua.arm7.elf File opened for reading /proc/7777|6/stat Aqua.arm7.elf File opened for reading /proc/6666 ;/stat Aqua.arm7.elf File opened for reading /proc/2222e*/cmdline Aqua.arm7.elf File opened for reading /proc/1111N-/stat Aqua.arm7.elf File opened for reading /proc/6666m5/stat Aqua.arm7.elf File opened for reading /proc/777747/stat Aqua.arm7.elf File opened for reading /proc/7777�7/stat Aqua.arm7.elf File opened for reading /proc/1111�"/stat Aqua.arm7.elf File opened for reading /proc/6666�:/cmdline Aqua.arm7.elf File opened for reading /proc/6666S1/cmdline Aqua.arm7.elf File opened for reading /proc/222/stat Aqua.arm7.elf File opened for reading /proc/1111M-/stat Aqua.arm7.elf File opened for reading /proc/2222 )/stat Aqua.arm7.elf File opened for reading /proc/66666/cmdline Aqua.arm7.elf File opened for reading /proc/3333/stat Aqua.arm7.elf File opened for reading /proc/6666q5/stat Aqua.arm7.elf