8056ea86da938944dbad0985174ee72aa247169947ab26ca4940f81035307425

Analysis

max time kernel
30s
max time network
133s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
02/07/2026, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_91d461dda8a1aefda6d364acaa037a70_glassworm_qnapcrypt
Size 4.2MB
Sample260702-ab6d4sf14m
SHA256 8056ea86da938944dbad0985174ee72aa247169947ab26ca4940f81035307425
MD5 91d461dda8a1aefda6d364acaa037a70
SHA1 c9a3757cfb2f98993ddf618baa1d4fc21aac27e6
SHA512 b8e9731c739978c922c7045e8553e8520ab7371a42f5cd0c580e3c9a3fa0ce0d2792aeaf43750da605656c59774289fba27dfecddaee7ac95f2bb8834b1631d4
SSDEEP 49152:7bSgHkn0ONtjTsc4U+Yk/assFeDE2ivhISx9OXiP62Ipou+ay8ar2Hr:7ZEr+oZvhIqaiP6ou+l85Hr
TLSH
T12326BE17FCA549A5C0AEA2318A769552BBB1BC491F2023D73FA0F7382F72BD05979740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-07-01_91d461dda8a1aefda6d364acaa037a70_glassworm_qnapcrypt

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/pkg_scanner_4233853756/manifest.json	2026-07-01_91d461dda8a1aefda6d364acaa037a70_glassworm_qnapcrypt
File opened for modification	/tmp/pkg_scanner_4233853756/package/bingo_ai-3.5.1-py3-none-any.whl	2026-07-01_91d461dda8a1aefda6d364acaa037a70_glassworm_qnapcrypt

/tmp/2026-07-01_91d461dda8a1aefda6d364acaa037a70_glassworm_qnapcrypt
/tmp/2026-07-01_91d461dda8a1aefda6d364acaa037a70_glassworm_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:1476
- /usr/bin/python3
  python3 --version
  2⤵
  PID:1481
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check /tmp/pkg_scanner_4233853756/package/bingo_ai-3.5.1-py3-none-any.whl
  2⤵
  PID:1485
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check --no-deps /tmp/pkg_scanner_4233853756/package/bingo_ai-3.5.1-py3-none-any.whl
  2⤵
  PID:1486
- /usr/bin/python3
  /usr/bin/python3 -c "import bingo"
  2⤵
  PID:1487
- /usr/bin/python3
  /usr/bin/python3 -c " import sys, types from importlib.abc import MetaPathFinder, Loader from importlib.machinery import ModuleSpec class _AnyMeta(type): def __getattr__(cls, n): return _Any def __getitem__(cls, k): return _Any class _Any(metaclass=_AnyMeta): def __init__(self, *a, **k): pass def __getattr__(self, n): return _Any def __setattr__(self, n, v): pass def __getitem__(self, k): return _Any def __call__(self, *a, **k): return _Any() def __iter__(self): return iter(()) class _StubLoader(Loader): def create_module(self, spec): m = types.ModuleType(spec.name) m.__path__ = [] m.__getattr__ = lambda n: _Any return m def exec_module(self, m): pass class _StubFinder(MetaPathFinder): def find_spec(self, name, path=None, target=None): return ModuleSpec(name, _StubLoader()) sys.meta_path.append(_StubFinder()) import bingo "
  2⤵
  PID:1488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path /tmp/pkg_scanner_4233853756/manifest.json
Size 178B
SHA256 680856cbbcac8fa1405b01e47a6b1559b3dca9691af6b38e0ad902bfe5b074e2
MD5 5e704fb54e7d63b6b03274e23ac0aad0
SHA1 a63ca03d70f454f2282c82eb367f8c42c690927c
SHA512 05f68c0b45987f84600c9a2929023195efaca81efa7cd9eea7f747ce491ee879a455b1a50c84417473191d33e02ecc5438db57f8b68e9b5164b0e96b9807c188
TLSH
T1F5C012A00029C36320E8EE802039581A481A6C2338C12CE4F3636E4001AAA92806322E
MD5 SHA1 SHA512 TLSH

Submit Download

bingo_ai-3.5.1-py3-none-any.whl

Path /tmp/pkg_scanner_4233853756/package/bingo_ai-3.5.1-py3-none-any.whl
Size 2.0MB
SHA256 e376ddbe1e1e018fba24e41701c30069505137fd35b598c11bfd8878ace8b07c
MD5 fc49a8cf1ad3a13cc4b967f1f84a7b5a
SHA1 d12aeec4fd80775badae1775c3b63676bbdf25f9
SHA512 0419efd6d4e031aad39dfadf8aa97bd22908e050e9c676c8b4273cbc2157c950e959af057aab2b960a2139c2fc9c9bc4fe407bcf50b13c9d5906bf7278608d09
SSDEEP 49152:WIAemEZO+dX+DzebV8x637nagwiNSGPTgCuKxPYB93WMFM8bsuny8aPj:WMfZOxz88o37BwKPruU7MFTy8A
TLSH
T18EA5237AC8034808E13C12BDE56A7705464D1A37759DA48EE8B08327F69B7DDE62F7E0
MD5 SHA1 SHA512 SSDEEP TLSH