Edit tour

Linux Analysis Report
Aqua.m68k.elf

Overview

General Information

Sample name:Aqua.m68k.elf
Analysis ID:1670832
MD5:b51edec11375250c9b50126515e3ba03
SHA1:b9c0976a656a4cfbf5bb5df20c8ade66400dcf91
SHA256:cb72535d8a83274bf86187c3df0eac3179662834ee5624f8c1c411e57a68548b
Tags:elfuser-abuse_ch
Infos:
Errors
  • No or unstable Internet during analysis

Detection

Aquabot
Score:60
Range:0 - 100

Signatures

Multi AV Scanner detection for submitted file
Yara detected Aquabot
Sample deletes itself
Creates hidden files and/or directories
Detected TCP or UDP traffic on non-standard ports
Enumerates processes within the "proc" file system
Found strings indicative of a multi-platform dropper
Sample has stripped symbol table
Sample tries to kill a process (SIGKILL)
Uses the "uname" system call to query kernel version information (possible evasion)

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Joe Sandbox version:42.0.0 Malachite
Analysis ID:1670832
Start date and time:2025-04-22 08:47:00 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 4m 30s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample name:Aqua.m68k.elf
Detection:MAL
Classification:mal60.troj.evad.linELF@0/1@0/0
  • No or unstable Internet during analysis
Command:/tmp/Aqua.m68k.elf
PID:5434
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
about to cum inside a femboy btw
Standard Error:
  • system is lnxubuntu20
  • Aqua.m68k.elf (PID: 5434, Parent: 5356, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/Aqua.m68k.elf
  • sh (PID: 5440, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill
  • gsd-rfkill (PID: 5440, Parent: 1588, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill
  • systemd New Fork (PID: 5445, Parent: 1)
  • systemd-hostnamed (PID: 5445, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed
  • cleanup
SourceRuleDescriptionAuthorStrings
Aqua.m68k.elfJoeSecurity_AquabotYara detected AquabotJoe Security
    SourceRuleDescriptionAuthorStrings
    5434.1.00007f7640001000.00007f7640016000.r-x.sdmpJoeSecurity_AquabotYara detected AquabotJoe Security
      Process Memory Space: Aqua.m68k.elf PID: 5434JoeSecurity_AquabotYara detected AquabotJoe Security
        No Suricata rule has matched

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Source: Aqua.m68k.elfVirustotal: Detection: 26%Perma Link
        Source: Aqua.m68k.elfReversingLabs: Detection: 30%
        Source: Aqua.m68k.elfString: N^NuEOF/proc//proc/%s/cmdlinerwgetcurlftpechokillbashrebootshutdownhaltpoweroff[locker] killed process: %s ;; pid: %d
        Source: global trafficTCP traffic: 192.168.2.13:44730 -> 89.190.156.145:7733
        Source: global trafficUDP traffic: 192.168.2.13:49222 -> 193.200.78.28:0
        Source: unknownTCP traffic detected without corresponding DNS query: 89.190.156.145
        Source: unknownTCP traffic detected without corresponding DNS query: 89.190.156.145
        Source: unknownTCP traffic detected without corresponding DNS query: 89.190.156.145
        Source: unknownTCP traffic detected without corresponding DNS query: 89.190.156.145
        Source: unknownTCP traffic detected without corresponding DNS query: 89.190.156.145
        Source: unknownTCP traffic detected without corresponding DNS query: 89.190.156.145
        Source: unknownTCP traffic detected without corresponding DNS query: 89.190.156.145
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: unknownUDP traffic detected without corresponding DNS query: 193.200.78.28
        Source: ELF static info symbol of initial sample.symtab present: no
        Source: /tmp/Aqua.m68k.elf (PID: 5438)SIGKILL sent: pid: 1884, result: successfulJump to behavior
        Source: classification engineClassification label: mal60.troj.evad.linELF@0/1@0/0
        Source: /usr/libexec/gsd-rfkill (PID: 5440)Directory: <invalid fd (9)>/..Jump to behavior
        Source: /usr/libexec/gsd-rfkill (PID: 5440)Directory: <invalid fd (8)>/..Jump to behavior
        Source: /lib/systemd/systemd-hostnamed (PID: 5445)Directory: <invalid fd (10)>/..Jump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/230/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/110/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/231/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/111/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/232/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/112/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/233/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/113/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/234/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/114/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/235/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/115/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/236/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/116/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/237/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/117/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/238/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/118/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/239/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/119/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/914/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/10/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/917/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/11/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/12/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/13/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/14/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/15/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/16/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/17/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/18/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/19/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/240/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/120/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/241/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/121/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/242/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/122/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/243/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/2/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/123/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/244/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/3/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/124/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/245/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/1588/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/125/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/4/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/246/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/126/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/5/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/247/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/127/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/6/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/248/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/128/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/7/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/249/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/129/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/8/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/800/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/9/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/802/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/803/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/20/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/21/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/22/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/23/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/24/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/25/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/26/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/27/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/28/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/29/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/1482/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/490/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/1480/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/250/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/371/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/130/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/251/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/131/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/252/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/132/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/253/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/254/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/1238/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/134/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/255/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/256/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/257/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/378/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/258/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/259/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/1475/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/936/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/30/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/816/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/35/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/260/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/261/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/262/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/142/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/263/cmdlineJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5438)File opened: /proc/264/cmdlineJump to behavior

        Hooking and other Techniques for Hiding and Protection

        barindex
        Source: /tmp/Aqua.m68k.elf (PID: 5436)File: /tmp/Aqua.m68k.elfJump to behavior
        Source: /tmp/Aqua.m68k.elf (PID: 5434)Queries kernel information via 'uname': Jump to behavior
        Source: /lib/systemd/systemd-hostnamed (PID: 5445)Queries kernel information via 'uname': Jump to behavior
        Source: Aqua.m68k.elf, 5434.1.00007ffd619d9000.00007ffd619fa000.rw-.sdmpBinary or memory string: 6x86_64/usr/bin/qemu-m68k/tmp/Aqua.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/Aqua.m68k.elf
        Source: Aqua.m68k.elf, 5434.1.00007ffd619d9000.00007ffd619fa000.rw-.sdmpBinary or memory string: /qemu-open.XXXXX
        Source: Aqua.m68k.elf, 5434.1.00007ffd619d9000.00007ffd619fa000.rw-.sdmpBinary or memory string: /usr/bin/qemu-m68k
        Source: Aqua.m68k.elf, 5434.1.00005635ad15f000.00005635ad1e4000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/m68k
        Source: Aqua.m68k.elf, 5434.1.00007ffd619d9000.00007ffd619fa000.rw-.sdmpBinary or memory string: /tmp/qemu-open.jJyvZ7
        Source: Aqua.m68k.elf, 5434.1.00005635ad15f000.00005635ad1e4000.rw-.sdmpBinary or memory string: 5V!/etc/qemu-binfmt/m68k
        Source: Aqua.m68k.elf, 5434.1.00007ffd619d9000.00007ffd619fa000.rw-.sdmpBinary or memory string: 5V/tmp/qemu-open.jJyvZ7\

        Stealing of Sensitive Information

        barindex
        Source: Yara matchFile source: Aqua.m68k.elf, type: SAMPLE
        Source: Yara matchFile source: 5434.1.00007f7640001000.00007f7640016000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: Aqua.m68k.elf PID: 5434, type: MEMORYSTR

        Remote Access Functionality

        barindex
        Source: Yara matchFile source: Aqua.m68k.elf, type: SAMPLE
        Source: Yara matchFile source: 5434.1.00007f7640001000.00007f7640016000.r-x.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: Aqua.m68k.elf PID: 5434, type: MEMORYSTR
        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity Information1
        Scripting
        Valid AccountsWindows Management Instrumentation1
        Scripting
        Path Interception1
        Hidden Files and Directories
        1
        OS Credential Dumping
        11
        Security Software Discovery
        Remote ServicesData from Local System1
        Non-Standard Port
        Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
        File Deletion
        LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
        No configs have been found
        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Number of created Files
        • Is malicious
        • Internet
        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1670832 Sample: Aqua.m68k.elf Startdate: 22/04/2025 Architecture: LINUX Score: 60 19 193.200.78.28, 0 LINK-SERVICE-ASUA Switzerland 2->19 21 89.190.156.145, 7733 HOSTUS-GLOBAL-ASHostUSHK United Kingdom 2->21 23 Multi AV Scanner detection for submitted file 2->23 25 Yara detected Aquabot 2->25 8 Aqua.m68k.elf 2->8         started        10 gnome-session-binary sh gsd-rfkill 2->10         started        12 systemd systemd-hostnamed 2->12         started        signatures3 process4 process5 14 Aqua.m68k.elf 8->14         started        signatures6 27 Sample deletes itself 14->27 17 Aqua.m68k.elf 14->17         started        process7
        SourceDetectionScannerLabelLink
        Aqua.m68k.elf27%VirustotalBrowse
        Aqua.m68k.elf31%ReversingLabsLinux.Backdoor.Mirai
        No Antivirus matches
        No Antivirus matches
        No Antivirus matches

        Download Network PCAP: filteredfull

        No contacted domains info
        • No. of IPs < 25%
        • 25% < No. of IPs < 50%
        • 50% < No. of IPs < 75%
        • 75% < No. of IPs
        IPDomainCountryFlagASNASN NameMalicious
        193.200.78.28
        unknownSwitzerland
        29496LINK-SERVICE-ASUAfalse
        89.190.156.145
        unknownUnited Kingdom
        7489HOSTUS-GLOBAL-ASHostUSHKfalse
        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
        193.200.78.28Aqua.arm5.elfGet hashmaliciousUnknownBrowse
          Aqua.sh4.elfGet hashmaliciousUnknownBrowse
            Aqua.mips.elfGet hashmaliciousUnknownBrowse
              Aqua.m68k.elfGet hashmaliciousUnknownBrowse
                Aqua.mpsl.elfGet hashmaliciousUnknownBrowse
                  Aqua.arm7.elfGet hashmaliciousMiraiBrowse
                    Aqua.x86.elfGet hashmaliciousUnknownBrowse
                      89.190.156.145Aqua.arm7.elfGet hashmaliciousAquabot, MiraiBrowse
                        Aqua.x86.elfGet hashmaliciousUnknownBrowse
                          Aqua.arm7.elfGet hashmaliciousMiraiBrowse
                            drea4.elfGet hashmaliciousUnknownBrowse
                              vjwe68k.elfGet hashmaliciousUnknownBrowse
                                efjepc.elfGet hashmaliciousUnknownBrowse
                                  Aqua.arm7.elfGet hashmaliciousMiraiBrowse
                                    Aqua.arm7.elfGet hashmaliciousMiraiBrowse
                                      drea4.elfGet hashmaliciousUnknownBrowse
                                        weje64.elfGet hashmaliciousUnknownBrowse
                                          No context
                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                          HOSTUS-GLOBAL-ASHostUSHKAqua.arm7.elfGet hashmaliciousAquabot, MiraiBrowse
                                          • 89.190.156.145
                                          1isequal9.spc.elfGet hashmaliciousUnknownBrowse
                                          • 185.122.56.74
                                          Aqua.x86.elfGet hashmaliciousUnknownBrowse
                                          • 89.190.156.145
                                          Aqua.arm7.elfGet hashmaliciousMiraiBrowse
                                          • 89.190.156.145
                                          bot.arm5.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                          • 89.190.156.158
                                          bot.m68k.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                          • 89.190.156.158
                                          bot.mips.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                          • 89.190.156.158
                                          bot.mpsl.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                          • 89.190.156.158
                                          bot.arm.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                          • 89.190.156.158
                                          bot.sh4.elfGet hashmaliciousMirai, Gafgyt, OkiruBrowse
                                          • 89.190.156.158
                                          LINK-SERVICE-ASUAAqua.arm5.elfGet hashmaliciousUnknownBrowse
                                          • 193.200.78.28
                                          Aqua.sh4.elfGet hashmaliciousUnknownBrowse
                                          • 193.200.78.28
                                          Aqua.mips.elfGet hashmaliciousUnknownBrowse
                                          • 193.200.78.28
                                          Aqua.m68k.elfGet hashmaliciousUnknownBrowse
                                          • 193.200.78.28
                                          Aqua.mpsl.elfGet hashmaliciousUnknownBrowse
                                          • 193.200.78.28
                                          Aqua.arm7.elfGet hashmaliciousMiraiBrowse
                                          • 193.200.78.28
                                          Aqua.x86.elfGet hashmaliciousUnknownBrowse
                                          • 193.200.78.28
                                          Aqua.arm7.elfGet hashmaliciousMiraiBrowse
                                          • 193.200.78.43
                                          Aqua.arm5.elfGet hashmaliciousUnknownBrowse
                                          • 193.200.78.43
                                          Aqua.x86.elfGet hashmaliciousUnknownBrowse
                                          • 193.200.78.43
                                          No context
                                          No context
                                          Process:/tmp/Aqua.m68k.elf
                                          File Type:data
                                          Category:dropped
                                          Size (bytes):29
                                          Entropy (8bit):4.254195650150781
                                          Encrypted:false
                                          SSDEEP:3:Tg9s+HJN:Tg9FJN
                                          MD5:F3F397AFAB5A2FAFD3ED15D9AC539FA5
                                          SHA1:00B3C1035E9A9C328B0F37AD2E20410918634831
                                          SHA-256:813A791800A8D59AC86723939917FF66B9D438D4A6BB7C81203E842AFF6C6FD8
                                          SHA-512:B241A66C747803C1B652C0B3613148CAB9E743389B5EB8E139EA3D2496A3BF7E375BD5F89CFCD5D20FA0CDCB47A6BDE4C42BEEAD18C89F5063CE0D277EDB9428
                                          Malicious:false
                                          Reputation:moderate, very likely benign file
                                          Preview:/tmp/Aqua.m68k.elf.nwlrbbmqbh
                                          File type:ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
                                          Entropy (8bit):6.210679264860724
                                          TrID:
                                          • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                          File name:Aqua.m68k.elf
                                          File size:85'244 bytes
                                          MD5:b51edec11375250c9b50126515e3ba03
                                          SHA1:b9c0976a656a4cfbf5bb5df20c8ade66400dcf91
                                          SHA256:cb72535d8a83274bf86187c3df0eac3179662834ee5624f8c1c411e57a68548b
                                          SHA512:6832eb121679c29738ca6eafb6ba3ba6606ade3ef5e3fbb022c87ea79958a352e54537c155ae58df71a99a3bcc8fe1b51c6ef170a08c0f2f9a8e53b06065f624
                                          SSDEEP:1536:x4Zn912Jo0Mf8J6o8MypxkcN3CB9R4g4TT7bpHvBylcUkRH:x4Zn9SRMf8J6aypxklBf4gGtBylneH
                                          TLSH:E2833AD7F400DD7DFC0ED77B4453090AB671A3A256831B3A6367B9A7AD321B40926F82
                                          File Content Preview:.ELF.......................D...4..Kl.....4. ...(......................F...F....... .......F...f...f....0..%....... .dt.Q............................NV..a....da.....N^NuNV..J9..k,f>"y..g. QJ.g.X.#...g.N."y..g. QJ.f.A.....J.g.Hy..F.N.X.......k,N^NuNV..N^NuN

                                          ELF header

                                          Class:ELF32
                                          Data:2's complement, big endian
                                          Version:1 (current)
                                          Machine:MC68000
                                          Version Number:0x1
                                          Type:EXEC (Executable file)
                                          OS/ABI:UNIX - System V
                                          ABI Version:0
                                          Entry Point Address:0x80000144
                                          Flags:0x0
                                          ELF Header Size:52
                                          Program Header Offset:52
                                          Program Header Size:32
                                          Number of Program Headers:3
                                          Section Header Offset:84844
                                          Section Header Size:40
                                          Number of Section Headers:10
                                          Header String Table Index:9
                                          NameTypeAddressOffsetSizeEntSizeFlagsFlags DescriptionLinkInfoAlign
                                          NULL0x00x00x00x00x0000
                                          .initPROGBITS0x800000940x940x140x00x6AX002
                                          .textPROGBITS0x800000a80xa80x12e420x00x6AX004
                                          .finiPROGBITS0x80012eea0x12eea0xe0x00x6AX002
                                          .rodataPROGBITS0x80012ef80x12ef80x17fd0x00x2A002
                                          .ctorsPROGBITS0x800166fc0x146fc0x80x00x3WA004
                                          .dtorsPROGBITS0x800167040x147040x80x00x3WA004
                                          .dataPROGBITS0x800167100x147100x41c0x00x3WA004
                                          .bssNOBITS0x80016b2c0x14b2c0x21bc0x00x3WA004
                                          .shstrtabSTRTAB0x00x14b2c0x3e0x00x0001
                                          TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                          LOAD0x00x800000000x800000000x146f50x146f56.23340x5R E0x2000.init .text .fini .rodata
                                          LOAD0x146fc0x800166fc0x800166fc0x4300x25ec3.75510x6RW 0x2000.ctors .dtors .data .bss
                                          GNU_STACK0x00x00x00x00x00.00000x6RW 0x4

                                          Download Network PCAP: filteredfull

                                          • Total Packets: 30
                                          • 7733 undefined
                                          • 0 undefined
                                          TimestampSource PortDest PortSource IPDest IP
                                          Apr 22, 2025 08:47:47.958455086 CEST447307733192.168.2.1389.190.156.145
                                          Apr 22, 2025 08:47:48.967694044 CEST447307733192.168.2.1389.190.156.145
                                          Apr 22, 2025 08:47:50.983643055 CEST447307733192.168.2.1389.190.156.145
                                          Apr 22, 2025 08:47:55.207669973 CEST447307733192.168.2.1389.190.156.145
                                          Apr 22, 2025 08:48:03.399662971 CEST447307733192.168.2.1389.190.156.145
                                          Apr 22, 2025 08:48:19.527736902 CEST447307733192.168.2.1389.190.156.145
                                          Apr 22, 2025 08:48:53.063633919 CEST447307733192.168.2.1389.190.156.145
                                          TimestampSource PortDest PortSource IPDest IP
                                          Apr 22, 2025 08:47:47.504123926 CEST492220192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:47:52.510481119 CEST607980192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:47:57.512954950 CEST509650192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:48:02.519207954 CEST552820192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:48:07.525724888 CEST362110192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:48:12.532361031 CEST449170192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:48:17.538944006 CEST512160192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:48:22.545058012 CEST404600192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:48:27.551507950 CEST442150192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:48:32.557161093 CEST342170192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:48:40.566096067 CEST378860192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:48:45.572362900 CEST412050192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:48:50.579124928 CEST432430192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:48:55.585335016 CEST433170192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:49:00.591934919 CEST335730192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:49:05.598514080 CEST371830192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:49:10.604736090 CEST520960192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:49:15.610971928 CEST356860192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:49:20.618083000 CEST425600192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:49:25.621043921 CEST576790192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:49:38.630326033 CEST530690192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:49:43.636653900 CEST584640192.168.2.13193.200.78.28
                                          Apr 22, 2025 08:49:48.642946959 CEST379880192.168.2.13193.200.78.28

                                          System Behavior

                                          Start time (UTC):06:47:46
                                          Start date (UTC):22/04/2025
                                          Path:/tmp/Aqua.m68k.elf
                                          Arguments:/tmp/Aqua.m68k.elf
                                          File size:4463432 bytes
                                          MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                          Start time (UTC):06:47:46
                                          Start date (UTC):22/04/2025
                                          Path:/tmp/Aqua.m68k.elf
                                          Arguments:-
                                          File size:4463432 bytes
                                          MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                          Start time (UTC):06:47:46
                                          Start date (UTC):22/04/2025
                                          Path:/tmp/Aqua.m68k.elf
                                          Arguments:-
                                          File size:4463432 bytes
                                          MD5 hash:cd177594338c77b895ae27c33f8f86cc

                                          Start time (UTC):06:47:47
                                          Start date (UTC):22/04/2025
                                          Path:/usr/libexec/gnome-session-binary
                                          Arguments:-
                                          File size:334664 bytes
                                          MD5 hash:d9b90be4f7db60cb3c2d3da6a1d31bfb

                                          Start time (UTC):06:47:47
                                          Start date (UTC):22/04/2025
                                          Path:/bin/sh
                                          Arguments:/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill
                                          File size:129816 bytes
                                          MD5 hash:1e6b1c887c59a315edb7eb9a315fc84c

                                          Start time (UTC):06:47:47
                                          Start date (UTC):22/04/2025
                                          Path:/usr/libexec/gsd-rfkill
                                          Arguments:/usr/libexec/gsd-rfkill
                                          File size:51808 bytes
                                          MD5 hash:88a16a3c0aba1759358c06215ecfb5cc

                                          Start time (UTC):06:47:47
                                          Start date (UTC):22/04/2025
                                          Path:/usr/lib/systemd/systemd
                                          Arguments:-
                                          File size:1620224 bytes
                                          MD5 hash:9b2bec7092a40488108543f9334aab75

                                          Start time (UTC):06:47:47
                                          Start date (UTC):22/04/2025
                                          Path:/lib/systemd/systemd-hostnamed
                                          Arguments:/lib/systemd/systemd-hostnamed
                                          File size:35040 bytes
                                          MD5 hash:2cc8a5576629a2d5bd98e49a4b8bef65