Analysis
-
max time kernel
130s -
max time network
152s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
02-01-2025 15:51
Behavioral task
behavioral1
Sample
Aqua.arm7.elf
Resource
debian9-armhf-20240611-en
debian-9-armhf
3 signatures
150 seconds
General
-
Target
Aqua.arm7.elf
-
Size
154KB
-
MD5
1021bcdbd3317439c8028eba6b621e08
-
SHA1
ef6f92fd8b9ce15c0af8ff379cedc6a8ffc85a36
-
SHA256
fc9ca464d8be8c202661ec5862c2b56b78f9cef824066d3dc32c3e58ee3a5f56
-
SHA512
168cd371ee931004406232b5692b1d3eacd53f211cb607eca5c3b0b1cba131c8328f5de74354e5fd1a062f926372497bdfb26de7cacff67b6ff78d317f14a08b
-
SSDEEP
3072:4f4fkx/LXeakFSesMI4oaZrS3FSO/DiEMmM/9nhJ+z+:4f4cx/7eakFSesMVoT3ESDiExM/93+a
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 651 Aqua.arm7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 650 Aqua.arm7.elf -
description ioc Process File opened for reading /proc/222v�"/cmdline Aqua.arm7.elf File opened for reading /proc/2222�*/cmdline Aqua.arm7.elf File opened for reading /proc/6666�3/cmdline Aqua.arm7.elf File opened for reading /proc/11/cmdline Aqua.arm7.elf File opened for reading /proc/2222�*/cmdline Aqua.arm7.elf File opened for reading /proc/2222�*/cmdline Aqua.arm7.elf File opened for reading /proc/5555u/cmdline Aqua.arm7.elf File opened for reading /proc/1111�"/cmdline Aqua.arm7.elf File opened for reading /proc/111/cmdline Aqua.arm7.elf File opened for reading /proc/111c�"/cmdline Aqua.arm7.elf File opened for reading /proc/2222x+/cmdline Aqua.arm7.elf File opened for reading /proc/77/cmdline Aqua.arm7.elf File opened for reading /proc/1111�3/cmdline Aqua.arm7.elf File opened for reading /proc/22/cmdline Aqua.arm7.elf File opened for reading /proc/111�"/cmdline Aqua.arm7.elf File opened for reading /proc/222�"/cmdline Aqua.arm7.elf File opened for reading /proc/444s�"/cmdline Aqua.arm7.elf File opened for reading /proc/3333/cmdline Aqua.arm7.elf File opened for reading /proc/66663/cmdline Aqua.arm7.elf File opened for reading /proc/6666�3/cmdline Aqua.arm7.elf File opened for reading /proc/99/cmdline Aqua.arm7.elf File opened for reading /proc/777s�"/cmdline Aqua.arm7.elf File opened for reading /proc/222�"/cmdline Aqua.arm7.elf File opened for reading /proc/2222.*/cmdline Aqua.arm7.elf File opened for reading /proc/1111�3/cmdline Aqua.arm7.elf File opened for reading /proc/3333�,/cmdline Aqua.arm7.elf File opened for reading /proc/6666�3/cmdline Aqua.arm7.elf File opened for reading /proc/444/cmdline Aqua.arm7.elf File opened for reading /proc/222/cmdline Aqua.arm7.elf File opened for reading /proc/1111�"/cmdline Aqua.arm7.elf File opened for reading /proc/1111�%/cmdline Aqua.arm7.elf File opened for reading /proc/1111�(/cmdline Aqua.arm7.elf File opened for reading /proc/2222b*/cmdline Aqua.arm7.elf File opened for reading /proc/6666�/cmdline Aqua.arm7.elf File opened for reading /proc/66665/cmdline Aqua.arm7.elf File opened for reading /proc/33/cmdline Aqua.arm7.elf File opened for reading /proc/55/cmdline Aqua.arm7.elf File opened for reading /proc/66660/cmdline Aqua.arm7.elf File opened for reading /proc/44/cmdline Aqua.arm7.elf File opened for reading /proc/2222v,/cmdline Aqua.arm7.elf File opened for reading /proc/6666�3/cmdline Aqua.arm7.elf File opened for reading /proc/6666�3/cmdline Aqua.arm7.elf File opened for reading /proc/88ll�"/cmdline Aqua.arm7.elf File opened for reading /proc/111c�"/cmdline Aqua.arm7.elf File opened for reading /proc/222l�"/cmdline Aqua.arm7.elf File opened for reading /proc/222s�"/cmdline Aqua.arm7.elf File opened for reading /proc/5555�/cmdline Aqua.arm7.elf File opened for reading /proc/6666O3/cmdline Aqua.arm7.elf File opened for reading /proc/66/cmdline Aqua.arm7.elf File opened for reading /proc/1111�3/cmdline Aqua.arm7.elf File opened for reading /proc/999�"/cmdline Aqua.arm7.elf File opened for reading /proc/3333�3/cmdline Aqua.arm7.elf File opened for reading /proc/6666�3/cmdline Aqua.arm7.elf File opened for reading /proc/222i�"/cmdline Aqua.arm7.elf File opened for reading /proc/1111�#/cmdline Aqua.arm7.elf File opened for reading /proc/1111�3/cmdline Aqua.arm7.elf File opened for reading /proc/3333|,/cmdline Aqua.arm7.elf File opened for reading /proc/111m�"/cmdline Aqua.arm7.elf File opened for reading /proc/6666�3/cmdline Aqua.arm7.elf File opened for reading /proc/111�"/cmdline Aqua.arm7.elf