Analysis
- max time kernel
149s - max time network
151s - platform
debian-12_armhf - resource
debian12-armhf-20260126-en - resource tags
arch:armhfimage:debian12-armhf-20260126-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
24/04/2026, 18:28
Behavioral task
behavioral1
Sample
concakhbtandhuy.arm7
Resource
debian12-armhf-20260126-en
debian-12-armhf
3 signatures
150 seconds
General
- Target concakhbtandhuy.arm7
- Size 170KB
- Sample260424-w4f6kshv7p
- SHA256 b3a14ed840620fb4866477e6db70b141e17cf95c98cbfc89ef5a2d8b7884a6f3
- MD5 4d0a53e7188b97f2694b419a974a808b
- SHA1 177422e3d81cdc4c800eb744c1f782e4d34c19b0
- SHA512 bf6f3d642f90511e5486dca8241a75e88a844d31e97d38c8f341569dc312bffe73939453aeb4e33501646148229eee4887b134231ca0b6718786323c4774311c
- SSDEEP 3072:ZlMwlDcBZrkuaGDQZxBDyyxeslB5x9j/Sk5Yo+M/RpZu+9:ZJDc3AuaGDQZzD//BzR/Ff+M/RpZn9
- TLSH T16B041A46EA404B13C0962BB5FADF421533239B6497EB73069528AFF43F8779E4F22905
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself a- M" ! 782 concakhbtandhuy.arm7 -
description ioc Process File opened for reading /proc/27/cmdline concakhbtandhuy.arm7 File opened for reading /proc/139/cmdline concakhbtandhuy.arm7 File opened for reading /proc/673/cmdline concakhbtandhuy.arm7 File opened for reading /proc/790/cmdline concakhbtandhuy.arm7 File opened for reading /proc/797/cmdline concakhbtandhuy.arm7 File opened for reading /proc/815/cmdline concakhbtandhuy.arm7 File opened for reading /proc/837/cmdline concakhbtandhuy.arm7 File opened for reading /proc/849/cmdline concakhbtandhuy.arm7 File opened for reading /proc/12/cmdline concakhbtandhuy.arm7 File opened for reading /proc/367/cmdline concakhbtandhuy.arm7 File opened for reading /proc/810/cmdline concakhbtandhuy.arm7 File opened for reading /proc/854/cmdline concakhbtandhuy.arm7 File opened for reading /proc/28/cmdline concakhbtandhuy.arm7 File opened for reading /proc/801/cmdline concakhbtandhuy.arm7 File opened for reading /proc/861/cmdline concakhbtandhuy.arm7 File opened for reading /proc/36/cmdline concakhbtandhuy.arm7 File opened for reading /proc/844/cmdline concakhbtandhuy.arm7 File opened for reading /proc/853/cmdline concakhbtandhuy.arm7 File opened for reading /proc/860/cmdline concakhbtandhuy.arm7 File opened for reading /proc/3/cmdline concakhbtandhuy.arm7 File opened for reading /proc/196/cmdline concakhbtandhuy.arm7 File opened for reading /proc/793/cmdline concakhbtandhuy.arm7 File opened for reading /proc/794/cmdline concakhbtandhuy.arm7 File opened for reading /proc/812/cmdline concakhbtandhuy.arm7 File opened for reading /proc/829/cmdline concakhbtandhuy.arm7 File opened for reading /proc/833/cmdline concakhbtandhuy.arm7 File opened for reading /proc/836/cmdline concakhbtandhuy.arm7 File opened for reading /proc/34/cmdline concakhbtandhuy.arm7 File opened for reading /proc/214/cmdline concakhbtandhuy.arm7 File opened for reading /proc/357/cmdline concakhbtandhuy.arm7 File opened for reading /proc/189/cmdline concakhbtandhuy.arm7 File opened for reading /proc/194/cmdline concakhbtandhuy.arm7 File opened for reading /proc/31/cmdline concakhbtandhuy.arm7 File opened for reading /proc/57/cmdline concakhbtandhuy.arm7 File opened for reading /proc/807/cmdline concakhbtandhuy.arm7 File opened for reading /proc/809/cmdline concakhbtandhuy.arm7 File opened for reading /proc/813/cmdline concakhbtandhuy.arm7 File opened for reading /proc/841/cmdline concakhbtandhuy.arm7 File opened for reading /proc/6/cmdline concakhbtandhuy.arm7 File opened for reading /proc/19/cmdline concakhbtandhuy.arm7 File opened for reading /proc/724/cmdline concakhbtandhuy.arm7 File opened for reading /proc/783/cmdline concakhbtandhuy.arm7 File opened for reading /proc/817/cmdline concakhbtandhuy.arm7 File opened for reading /proc/1/cmdline concakhbtandhuy.arm7 File opened for reading /proc/29/cmdline concakhbtandhuy.arm7 File opened for reading /proc/333/cmdline concakhbtandhuy.arm7 File opened for reading /proc/827/cmdline concakhbtandhuy.arm7 File opened for reading /proc/32/cmdline concakhbtandhuy.arm7 File opened for reading /proc/46/cmdline concakhbtandhuy.arm7 File opened for reading /proc/766/cmdline concakhbtandhuy.arm7 File opened for reading /proc/780/cmdline concakhbtandhuy.arm7 File opened for reading /proc/816/cmdline concakhbtandhuy.arm7 File opened for reading /proc/16/cmdline concakhbtandhuy.arm7 File opened for reading /proc/17/cmdline concakhbtandhuy.arm7 File opened for reading /proc/22/cmdline concakhbtandhuy.arm7 File opened for reading /proc/364/cmdline concakhbtandhuy.arm7 File opened for reading /proc/7/cmdline concakhbtandhuy.arm7 File opened for reading /proc/42/cmdline concakhbtandhuy.arm7 File opened for reading /proc/667/cmdline concakhbtandhuy.arm7 File opened for reading /proc/778/cmdline concakhbtandhuy.arm7 File opened for reading /proc/9/cmdline concakhbtandhuy.arm7 File opened for reading /proc/21/cmdline concakhbtandhuy.arm7 File opened for reading /proc/35/cmdline concakhbtandhuy.arm7 File opened for reading /proc/292/cmdline concakhbtandhuy.arm7