Analysis
- max time kernel
143s - max time network
155s - platform
debian-12_armhf - resource
debian12-armhf-20240221-en - resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
25/01/2025, 04:28
Behavioral task
behavioral1
Sample
Aqua.arm7.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
3 signatures
150 seconds
General
- Target Aqua.arm7.elf
- Size 205KB
- Sample250125-e3netswkbs
- SHA256 471ea8978d65fe10135eab3d50bfbb37efe60f2f2b7b516adf39d9606778e0ca
- MD5 f6d3cb6d06fb441fb026c0bcce8b0ae4
- SHA1 3e478220c7d4d230f484e613bc757ec88d442550
- SHA512 566dd976e4af1036efd7c2a5ee63416ada04ae3ab579c0238b6620250e15ec639b0364d81cc80f1aefcaa7d9d1e72eba6846462e3bb712f811d4cb90a3368cab
- SSDEEP 6144:Rdq+j3uigacvucaDxoWCZGq8kvVpM+uxGM/RzMIu:R/j3u2aucadoWCZHP9p2xf/uIu
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 714 Aqua.arm7.elf - Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 712 Aqua.arm7.elf -
description ioc Process File opened for reading /proc/333s�/cmdline Aqua.arm7.elf File opened for reading /proc/555k�/cmdline Aqua.arm7.elf File opened for reading /proc/1111Y0/cmdline Aqua.arm7.elf File opened for reading /proc/3333t4/cmdline Aqua.arm7.elf File opened for reading /proc/111l/cmdline Aqua.arm7.elf File opened for reading /proc/111/cmdline Aqua.arm7.elf File opened for reading /proc/333/cmdline Aqua.arm7.elf File opened for reading /proc/2222T4/cmdline Aqua.arm7.elf File opened for reading /proc/3333�4/cmdline Aqua.arm7.elf File opened for reading /proc/6666�;/cmdline Aqua.arm7.elf File opened for reading /proc/77/cmdline Aqua.arm7.elf File opened for reading /proc/444/cmdline Aqua.arm7.elf File opened for reading /proc/2222�2/cmdline Aqua.arm7.elf File opened for reading /proc/6666�;/cmdline Aqua.arm7.elf File opened for reading /proc/7777&</cmdline Aqua.arm7.elf File opened for reading /proc/333�/cmdline Aqua.arm7.elf File opened for reading /proc/4444#8/cmdline Aqua.arm7.elf File opened for reading /proc/6666t;/cmdline Aqua.arm7.elf File opened for reading /proc/222/cmdline Aqua.arm7.elf File opened for reading /proc/222�/cmdline Aqua.arm7.elf File opened for reading /proc/111c|/cmdline Aqua.arm7.elf File opened for reading /proc/33335/cmdline Aqua.arm7.elf File opened for reading /proc/5555?8/cmdline Aqua.arm7.elf File opened for reading /proc/7777/cmdline Aqua.arm7.elf File opened for reading /proc/222v�/cmdline Aqua.arm7.elf File opened for reading /proc/1111</cmdline Aqua.arm7.elf File opened for reading /proc/33335/cmdline Aqua.arm7.elf File opened for reading /proc/111v/cmdline Aqua.arm7.elf File opened for reading /proc/333�/cmdline Aqua.arm7.elf File opened for reading /proc/333s�/cmdline Aqua.arm7.elf File opened for reading /proc/5555"</cmdline Aqua.arm7.elf File opened for reading /proc/22/cmdline Aqua.arm7.elf File opened for reading /proc/777/cmdline Aqua.arm7.elf File opened for reading /proc/4444�6/cmdline Aqua.arm7.elf File opened for reading /proc/7777</cmdline Aqua.arm7.elf File opened for reading /proc/444s�/cmdline Aqua.arm7.elf File opened for reading /proc/111ut/cmdline Aqua.arm7.elf File opened for reading /proc/222l�/cmdline Aqua.arm7.elf File opened for reading /proc/3333 5/cmdline Aqua.arm7.elf File opened for reading /proc/7777%</cmdline Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/7777</cmdline Aqua.arm7.elf File opened for reading /proc/55/cmdline Aqua.arm7.elf File opened for reading /proc/1111�/cmdline Aqua.arm7.elf File opened for reading /proc/3333f5/cmdline Aqua.arm7.elf File opened for reading /proc/7777$</cmdline Aqua.arm7.elf File opened for reading /proc/7777'</cmdline Aqua.arm7.elf File opened for reading /proc/222c�/cmdline Aqua.arm7.elf File opened for reading /proc/3333�4/cmdline Aqua.arm7.elf File opened for reading /proc/6666�;/cmdline Aqua.arm7.elf File opened for reading /proc/88/cmdline Aqua.arm7.elf File opened for reading /proc/111c~/cmdline Aqua.arm7.elf File opened for reading /proc/2222�3/cmdline Aqua.arm7.elf File opened for reading /proc/7777 </cmdline Aqua.arm7.elf File opened for reading /proc/44/cmdline Aqua.arm7.elf File opened for reading /proc/222m�/cmdline Aqua.arm7.elf File opened for reading /proc/555/cmdline Aqua.arm7.elf File opened for reading /proc/3333fffffff/cmdline Aqua.arm7.elf File opened for reading /proc/6666#</cmdline Aqua.arm7.elf File opened for reading /proc/11/cmdline Aqua.arm7.elf File opened for reading /proc/99ssj/cmdline Aqua.arm7.elf File opened for reading /proc/3333�6/cmdline Aqua.arm7.elf File opened for reading /proc/66/cmdline Aqua.arm7.elf File opened for reading /proc/222�/cmdline Aqua.arm7.elf