Extracted

• • Target
    2026-06-28_b4e468302978ba3e399fdc007fdbd563_glassworm_qnapcrypt
  • Size 1.8MB
  • SHA256 2b3c5739c6037e1ee6dcd04d4631fbee2aeb316fcedb20e367b015a7a4e6cb6f
  • MD5 b4e468302978ba3e399fdc007fdbd563
  • SHA1 65003e32fee499b2c766b01fdc2174bc5996c236
  • SHA512 5bcccb6592dd3dd47908f0de11704ccb245b97eef0b85a067fbd133410a4d711baa9aafecd307cae510492d20f27a69396fd3c34beeeaada22294d08162e7998
  • SSDEEP 24576:ae9ufJvk4gQjMNRfktnsIXvZFyD9i+MPCIxyuzNqssZXJjgbdYVVMtIwWz1v:WYMnwRO4ssP0d5Wz1
  • TLSH
    T131951711F98B54F2E9071A3104AFA26F27319D054F34EBC7EA40BB6AFD776D20932259
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionkaijipersistenceprivilege_escalation

  • Family: Kaiji

    Kaiji is a multi-functional malware written Golang.

    botnetkaiji

  • Kaiji

    Kaiji payload

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence

  • Modifies Bash startup script

    persistence
  behavioral1