da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69

Analysis

max time kernel
137s
max time network
144s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20250307-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20250307-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
23/03/2025, 19:48 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Aqua.x86.elf
Size

61KB
MD5

ae403ef91f4a5a63f9fea903f5c2a598
SHA1

409ca9d7ea942a3eca0d81367ebf5d3843cd3a7a
SHA256

da92f6515014f5f4ca9d22cee708f921a0a2228fdc8220cb188e2b345d9b6e69
SHA512

5982ee2a78b44b85e1b9c13f613683d0c4ecefe3305e69a289c6691caa7c5f1e6a16d19b2a2593b72e92d87f723bb85144efd4f249717a8c4294d22811a928c1
SSDEEP

1536:hsJzVTBEV6t+sJ9b6Vc53mr/OyucnIA3Bda9X81OwoO7R:uJBVEV6tZ2c9mr/OyfnZBaM1F

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid
1572

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 1 IoCs

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	httpd	1571

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc
File opened for reading	/proc/6/cmdline
File opened for reading	/proc/23/cmdline
File opened for reading	/proc/586/cmdline
File opened for reading	/proc/976/cmdline
File opened for reading	/proc/2/cmdline
File opened for reading	/proc/9/cmdline
File opened for reading	/proc/24/cmdline
File opened for reading	/proc/164/cmdline
File opened for reading	/proc/314/cmdline
File opened for reading	/proc/747/cmdline
File opened for reading	/proc/1095/cmdline
File opened for reading	/proc/1096/cmdline
File opened for reading	/proc/587/cmdline
File opened for reading	/proc/640/cmdline
File opened for reading	/proc/1011/cmdline
File opened for reading	/proc/1041/cmdline
File opened for reading	/proc/4/cmdline
File opened for reading	/proc/217/cmdline
File opened for reading	/proc/557/cmdline
File opened for reading	/proc/592/cmdline
File opened for reading	/proc/904/cmdline
File opened for reading	/proc/83/cmdline
File opened for reading	/proc/91/cmdline
File opened for reading	/proc/96/cmdline
File opened for reading	/proc/195/cmdline
File opened for reading	/proc/426/cmdline
File opened for reading	/proc/119/cmdline
File opened for reading	/proc/377/cmdline
File opened for reading	/proc/5/cmdline
File opened for reading	/proc/17/cmdline
File opened for reading	/proc/25/cmdline
File opened for reading	/proc/80/cmdline
File opened for reading	/proc/92/cmdline
File opened for reading	/proc/93/cmdline
File opened for reading	/proc/98/cmdline
File opened for reading	/proc/227/cmdline
File opened for reading	/proc/75/cmdline
File opened for reading	/proc/612/cmdline
File opened for reading	/proc/634/cmdline
File opened for reading	/proc/965/cmdline
File opened for reading	/proc/1027/cmdline
File opened for reading	/proc/1046/cmdline
File opened for reading	/proc/1092/cmdline
File opened for reading	/proc/207/cmdline
File opened for reading	/proc/766/cmdline
File opened for reading	/proc/780/cmdline
File opened for reading	/proc/1020/cmdline
File opened for reading	/proc/15/cmdline
File opened for reading	/proc/410/cmdline
File opened for reading	/proc/639/cmdline
File opened for reading	/proc/86/cmdline
File opened for reading	/proc/202/cmdline
File opened for reading	/proc/417/cmdline
File opened for reading	/proc/731/cmdline
File opened for reading	/proc/1093/cmdline
File opened for reading	/proc/77/cmdline
File opened for reading	/proc/82/cmdline
File opened for reading	/proc/211/cmdline
File opened for reading	/proc/213/cmdline
File opened for reading	/proc/263/cmdline
File opened for reading	/proc/588/cmdline
File opened for reading	/proc/761/cmdline
File opened for reading	/proc/800/cmdline
File opened for reading	/proc/11/cmdline

Network

DNS

kumalala.cloudboats.vip

Remote address:

8.8.8.8:53

Request

kumalala.cloudboats.vip

IN A
DNS

kumalala.cloudboats.vip

Remote address:

8.8.8.8:53

Request

kumalala.cloudboats.vip

IN A

Response

kumalala.cloudboats.vip

IN A

89.144.32.113
DNS

Remote address:

8.8.8.8:53

Response
DNS

Remote address:

8.8.8.8:53

Response
DNS

Remote address:

8.8.8.8:53

Response
DNS

Remote address:

8.8.8.8:53

Response
DNS

Remote address:

8.8.8.8:53

Response
DNS

Remote address:

8.8.8.8:53

Response
DNS

Remote address:

8.8.8.8:53

Response
DNS

Remote address:

8.8.8.8:53

Response
DNS

Remote address:

8.8.8.8:53

Response
DNS

Remote address:

8.8.8.8:53

Response
DNS

Remote address:

8.8.8.8:53

Response
DNS

Remote address:

8.8.8.8:53

Response
DNS

Remote address:

8.8.8.8:53

Response

89.190.156.145:7733

420 B
7
89.144.32.113:33966

kumalala.cloudboats.vip

531 B
303 B
10
5
89.144.32.113:33966

kumalala.cloudboats.vip

809 B
742 B
15
14

224.0.0.251:5353

146 B
2
8.8.8.8:53

kumalala.cloudboats.vip

dns

69 B
1

DNS Request

kumalala.cloudboats.vip
8.8.8.8:53

kumalala.cloudboats.vip

dns

69 B
85 B
1
1

DNS Request

kumalala.cloudboats.vip

DNS Response

89.144.32.113
8.8.8.8:53

dns

70 B
40 B
1
1
8.8.8.8:53

dns

70 B
40 B
1
1
8.8.8.8:53

dns

70 B
40 B
1
1
8.8.8.8:53

dns

70 B
40 B
1
1
8.8.8.8:53

dns

70 B
40 B
1
1
8.8.8.8:53

dns

69 B
40 B
1
1
8.8.8.8:53

dns

69 B
1
8.8.8.8:53

dns

69 B
40 B
1
1
8.8.8.8:53

dns

69 B
40 B
1
1
8.8.8.8:53

dns

69 B
40 B
1
1
8.8.8.8:53

dns

70 B
1
8.8.8.8:53

dns

70 B
40 B
1
1
8.8.8.8:53

dns

70 B
40 B
1
1
8.8.8.8:53

dns

70 B
40 B
1
1
8.8.8.8:53

dns

70 B
40 B
1
1

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Response

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.