d38081f5a054ee7dcba80287870995efbdf3c3acbd5a20b96e0d0f5ecdb60238

Analysis

max time kernel
30s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
01/07/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_8ffa8030abeca2b4457bbc3febdc968d_glassworm_qnapcrypt
Size 2.8MB
Sample260701-eefebafx6z
SHA256 d38081f5a054ee7dcba80287870995efbdf3c3acbd5a20b96e0d0f5ecdb60238
MD5 8ffa8030abeca2b4457bbc3febdc968d
SHA1 44d2dadd1fec15c6b287d911dda27960e9e4112e
SHA512 1e3596721cf8df26234eea8ead2167bc17f4534bb1452c77f33cb7928468728e7865c5dde78350af60956239a7f87028a2cc40afe471464b7ecb879480568a11
SSDEEP 49152:7bSgHkn0ONtjTsc4U+Yk/aDzrIhgbEeULv:7ZEr1ghgXUT
TLSH
T127D56A17FCA549A5C0AAA2318A729552BBB1BC491F2023D73FA0F73C2F72BD05979744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-06-30_8ffa8030abeca2b4457bbc3febdc968d_glassworm_qnapcrypt

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/pkg_scanner_85810833/package/bayyinah-1.6.0-py3-none-any.whl	2026-06-30_8ffa8030abeca2b4457bbc3febdc968d_glassworm_qnapcrypt
File opened for modification	/tmp/pkg_scanner_85810833/manifest.json	2026-06-30_8ffa8030abeca2b4457bbc3febdc968d_glassworm_qnapcrypt

/tmp/2026-06-30_8ffa8030abeca2b4457bbc3febdc968d_glassworm_qnapcrypt
/tmp/2026-06-30_8ffa8030abeca2b4457bbc3febdc968d_glassworm_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:1515
- /usr/bin/python3
  python3 --version
  2⤵
  PID:1521
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check /tmp/pkg_scanner_85810833/package/bayyinah-1.6.0-py3-none-any.whl
  2⤵
  PID:1522
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check --no-deps /tmp/pkg_scanner_85810833/package/bayyinah-1.6.0-py3-none-any.whl
  2⤵
  PID:1525
- /usr/bin/python3
  /usr/bin/python3 -c "import analyzers"
  2⤵
  PID:1526
- /usr/bin/python3
  /usr/bin/python3 -c " import sys, types from importlib.abc import MetaPathFinder, Loader from importlib.machinery import ModuleSpec class _AnyMeta(type): def __getattr__(cls, n): return _Any def __getitem__(cls, k): return _Any class _Any(metaclass=_AnyMeta): def __init__(self, *a, **k): pass def __getattr__(self, n): return _Any def __setattr__(self, n, v): pass def __getitem__(self, k): return _Any def __call__(self, *a, **k): return _Any() def __iter__(self): return iter(()) class _StubLoader(Loader): def create_module(self, spec): m = types.ModuleType(spec.name) m.__path__ = [] m.__getattr__ = lambda n: _Any return m def exec_module(self, m): pass class _StubFinder(MetaPathFinder): def find_spec(self, name, path=None, target=None): return ModuleSpec(name, _StubLoader()) sys.meta_path.append(_StubFinder()) import analyzers "
  2⤵
  PID:1531

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path /tmp/pkg_scanner_85810833/manifest.json
Size 182B
SHA256 050f6eaac8be0f76e01c06d604fef80364400e35a43449aa1b269c52ad1be82c
MD5 ba7f6b4881489039c4a1a679b9f8dd53
SHA1 e06c5af6a31f049e2ef21c750f408524e815f9b4
SHA512 69b28b089160072cd654a8f79b0d484606ec66bc93095e071de24c45ebb143dafb916a62f2e1b8cf6e06eb9cdb53dd5571c08635dc173d7cf6c01e54ea7b5ee9
TLSH
T110C08CB2402AD293E1E0DED0287C02130D9F2C33A9C03EC0F3833F8041AEA6AC06328D
MD5 SHA1 SHA512 TLSH

Submit Download

bayyinah-1.6.0-py3-none-any.whl

Path /tmp/pkg_scanner_85810833/package/bayyinah-1.6.0-py3-none-any.whl
Size 512KB
SHA256 00a6809b24b5ef14452c0a599367d4ae1213d655c3c09a3a3b338d32d6f45e51
MD5 64798aaf447d0e564bfc3b8190af011a
SHA1 2adc1410a2b50723ad8e9a468ecfbf8874e2e1eb
SHA512 a11760de0f2d293151b65ae2fe5caa28d91fe1df98fd60a0b0445ed7b351a8cee3ad1c7b57574faf815f7089df8789d8cee13aa288dac7037fcc59a764b0bf31
SSDEEP 12288:rIrO9GOd2uWnVHql7BK91CktuqXOWvWJPLdOjlsqSe/oPt4bW:D9GK2uyHql7BKCkthX9WJP5OBsqSUoPb
TLSH
T11DB4234E89E6C025C70E61F36CF59FB959792B00E3C9BDB7A9DAB30580DB06E8351385
MD5 SHA1 SHA512 SSDEEP TLSH