Analysis
-
max time kernel
149s -
max time network
156s -
platform
debian-12_armhf -
resource
debian12-armhf-20240221-en -
resource tags
arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem -
submitted
07-02-2025 15:16
Behavioral task
behavioral1
Sample
Aqua.arm7.elf
Resource
debian12-armhf-20240221-en
debian-12-armhf
3 signatures
150 seconds
General
-
Target
Aqua.arm7.elf
-
Size
187KB
-
MD5
80ffa1f3c31273d21529327393e64b24
-
SHA1
b5af4808250a7fddad586ce971b87fc19cb6acda
-
SHA256
b9ee5736d596c35f878c1f5f2d13e5cb53b430b0ad891ba9b1b34cfe180fa8e1
-
SHA512
54cec2d8a6c1c088e7d2f9015e8879a94b2c030f5c43ce8f7de8025a9ddf0fab048b6c36cf0f76c2a532a9cde233954000735b8755c370a539c3edeec686979e
-
SSDEEP
3072:oGdkMq+jB5uW0mgac1x9kcaDxoWCZ8NrTy8sLmMeOpM+D6soGM/RzV:Rdq+j3uigacvucaDxoWCZGq8kvVpM+u9
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 710 Aqua.arm7.elf -
Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself httpd 706 Aqua.arm7.elf -
description ioc Process File opened for reading /proc/555s�/cmdline Aqua.arm7.elf File opened for reading /proc/777k�/stat Aqua.arm7.elf File opened for reading /proc/7777Q;/stat Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/7777/stat Aqua.arm7.elf File opened for reading /proc/33/stat Aqua.arm7.elf File opened for reading /proc/111~/stat Aqua.arm7.elf File opened for reading /proc/111c�/stat Aqua.arm7.elf File opened for reading /proc/3333O5/stat Aqua.arm7.elf File opened for reading /proc/7777�;/stat Aqua.arm7.elf File opened for reading /proc/111t/stat Aqua.arm7.elf File opened for reading /proc/222l�/stat Aqua.arm7.elf File opened for reading /proc/1111h0/stat Aqua.arm7.elf File opened for reading /proc/3333{4/stat Aqua.arm7.elf File opened for reading /proc/6666f;/stat Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/7777�;/stat Aqua.arm7.elf File opened for reading /proc/222�/cmdline Aqua.arm7.elf File opened for reading /proc/2222�2/cmdline Aqua.arm7.elf File opened for reading /proc/6666�7/cmdline Aqua.arm7.elf File opened for reading /proc/555/stat Aqua.arm7.elf File opened for reading /proc/6666d;/stat Aqua.arm7.elf File opened for reading /proc/6666g;/cmdline Aqua.arm7.elf File opened for reading /proc/11/cmdline Aqua.arm7.elf File opened for reading /proc/1111h0/cmdline Aqua.arm7.elf File opened for reading /proc/7777g;/cmdline Aqua.arm7.elf File opened for reading /proc/1111];/stat Aqua.arm7.elf File opened for reading /proc/333s�/stat Aqua.arm7.elf File opened for reading /proc/3333 5/stat Aqua.arm7.elf File opened for reading /proc/6666�7/stat Aqua.arm7.elf File opened for reading /proc/6666 ;/stat Aqua.arm7.elf File opened for reading /proc/33/cmdline Aqua.arm7.elf File opened for reading /proc/6666�:/cmdline Aqua.arm7.elf File opened for reading /proc/7777/cmdline Aqua.arm7.elf File opened for reading /proc/222m�/stat Aqua.arm7.elf File opened for reading /proc/7777s;/cmdline Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/7777�;/stat Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/111c�/cmdline Aqua.arm7.elf File opened for reading /proc/222/cmdline Aqua.arm7.elf File opened for reading /proc/222�/stat Aqua.arm7.elf File opened for reading /proc/2222[4/stat Aqua.arm7.elf File opened for reading /proc/77779</cmdline Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/3333�4/cmdline Aqua.arm7.elf File opened for reading /proc/7777Z;/cmdline Aqua.arm7.elf File opened for reading /proc/2222�3/stat Aqua.arm7.elf File opened for reading /proc/6666e;/stat Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/7777�;/stat Aqua.arm7.elf File opened for reading /proc/333/cmdline Aqua.arm7.elf File opened for reading /proc/555/cmdline Aqua.arm7.elf File opened for reading /proc/7777o;/cmdline Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/6666g;/stat Aqua.arm7.elf File opened for reading /proc/7777�;/cmdline Aqua.arm7.elf File opened for reading /proc/7777�;/stat Aqua.arm7.elf File opened for reading /proc/333s�/cmdline Aqua.arm7.elf File opened for reading /proc/2222[4/cmdline Aqua.arm7.elf File opened for reading /proc/99ssr/stat Aqua.arm7.elf File opened for reading /proc/6666�8/stat Aqua.arm7.elf File opened for reading /proc/333365/cmdline Aqua.arm7.elf File opened for reading /proc/111u|/cmdline Aqua.arm7.elf