9c24371ced6658066d43244e7147a139bd4c4676a028fa7516b4ed2c387413d6

Analysis

max time kernel
30s
max time network
133s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
30/06/2026, 20:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_9f7521323ed39a9345de5533ee3f3cce_glassworm_qnapcrypt
Size 4.1MB
Sample260630-yymsaagy21
SHA256 9c24371ced6658066d43244e7147a139bd4c4676a028fa7516b4ed2c387413d6
MD5 9f7521323ed39a9345de5533ee3f3cce
SHA1 dc6c4b70bae9fdcbe9941778651e08b4487f9a28
SHA512 fd6c36011051b80abb01f4d639d43941831a6aeb99b51dcc5618b7904d5ec5a5071f93c48dcff6db98d29087ceec3954bbab146d0c9d43d8241afd6a939b64f5
SSDEEP 49152:7bSgHkn0ONtjTsc4U+Yk/ae6AcEiXfu31UmAmC3h5e8wRAKjST6UArkqEjj:7ZEr06A1lUmpC/ehQWUArP+j
TLSH
T1BE16AD17FCA549A5C0AEA2318A729552BBB1BC491F2023D72FA0F73C2F72BD05979744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-06-30_9f7521323ed39a9345de5533ee3f3cce_glassworm_qnapcrypt

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/pkg_scanner_928739560/package/industrialxpl_forge-1.0.44-py3-none-any.whl	2026-06-30_9f7521323ed39a9345de5533ee3f3cce_glassworm_qnapcrypt
File opened for modification	/tmp/pkg_scanner_928739560/manifest.json	2026-06-30_9f7521323ed39a9345de5533ee3f3cce_glassworm_qnapcrypt

/tmp/2026-06-30_9f7521323ed39a9345de5533ee3f3cce_glassworm_qnapcrypt
/tmp/2026-06-30_9f7521323ed39a9345de5533ee3f3cce_glassworm_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:1491
- /usr/bin/python3
  python3 --version
  2⤵
  PID:1498
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check /tmp/pkg_scanner_928739560/package/industrialxpl_forge-1.0.44-py3-none-any.whl
  2⤵
  PID:1499
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check --no-deps /tmp/pkg_scanner_928739560/package/industrialxpl_forge-1.0.44-py3-none-any.whl
  2⤵
  PID:1503
- /usr/bin/python3
  /usr/bin/python3 -c "import industrialxpl"
  2⤵
  PID:1505
- /usr/bin/python3
  /usr/bin/python3 -c " import sys, types from importlib.abc import MetaPathFinder, Loader from importlib.machinery import ModuleSpec class _AnyMeta(type): def __getattr__(cls, n): return _Any def __getitem__(cls, k): return _Any class _Any(metaclass=_AnyMeta): def __init__(self, *a, **k): pass def __getattr__(self, n): return _Any def __setattr__(self, n, v): pass def __getitem__(self, k): return _Any def __call__(self, *a, **k): return _Any() def __iter__(self): return iter(()) class _StubLoader(Loader): def create_module(self, spec): m = types.ModuleType(spec.name) m.__path__ = [] m.__getattr__ = lambda n: _Any return m def exec_module(self, m): pass class _StubFinder(MetaPathFinder): def find_spec(self, name, path=None, target=None): return ModuleSpec(name, _StubLoader()) sys.meta_path.append(_StubFinder()) import industrialxpl "
  2⤵
  PID:1506

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path /tmp/pkg_scanner_928739560/manifest.json
Size 210B
SHA256 6e24df8df9926e1c17418d9418b559a10e2e0744cd5e8efa038820e1fc70c6ee
MD5 e14b1c0f84117c50b90b47abfc453628
SHA1 50b95dab9b2748825561ccc61966c23e5b2f016d
SHA512 1e6c09e0f621fd28cdd30ed290056bd8479206c6ca965c846c0f48dabf1b30b668438795e4f6997a7460ff51b736e3c18ce67ce9226d38a2749180413e5a5682
TLSH
T1C1D01254092AC25710E4DFD014B918130C9B5C3330C43AE0B3C2AE4482EFD53C07721D
MD5 SHA1 SHA512 TLSH

Submit Download

industrialxpl_forge-1.0.44-py3-none-any.whl

Path /tmp/pkg_scanner_928739560/package/industrialxpl_forge-1.0.44-py3-none-any.whl
Size 2.1MB
SHA256 457f076c411a659da82f238f2c9f6e72f149b13aaf4dd9a14a764e2063e553c0
MD5 af6a70d4f9108240e00829472903b240
SHA1 73c5f2b01daf5efbc52d1d9967530d4cc49921f5
SHA512 321138aa3a05e614c15b8f7e605e3a93548f736e29353ee036cbb648a725da3f0914664f33586b9cae60bc1906245b9807a3a2e9c38b37ef0113e8574fff3ad3
SSDEEP 49152:wscb/PW49eNccwdTInPGQOCKzi5pGJ54TOCg4Ud9MJ:wscTGRwESRzgGz4SCqm
TLSH
T189A5BF64B33A862FE45F75F4B1A6E5D29DDC91D364E0236A71EC4498C0EBDA233B012D
MD5 SHA1 SHA512 SSDEEP TLSH