4bea3f2979d6a4fc71e8b7749da975556892aca2c6179c7c6d84f6604f183a60

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
05/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_09e32087a62cd048ef05f6a553fe76bd_glassworm_qnapcrypt
Size 4.6MB
Sample260705-ejlrwshv2z
SHA256 4bea3f2979d6a4fc71e8b7749da975556892aca2c6179c7c6d84f6604f183a60
MD5 09e32087a62cd048ef05f6a553fe76bd
SHA1 780f3eea74b62801e01f6668568ea951daa63710
SHA512 2c2c5afefb94e8fd2c530a6862421d590984fdfbf1a9592bd703c3673d877abb9018cc52433586f68489d7668cc14677bb72582b9448660e90242696d8efb34a
SSDEEP 49152:Gvm/U4L6t06nt49UXZPMFi+ntQE29t64lhpYFovnjxJJtEAN8op2u+qFVnrZ3Gjb:G+/DpCGJtasQ1kopQqnt3GP
TLSH
T1B6267B17FCA509AAC4EAA231896792527B71BC490B3023D73B50F7382F76BD06DB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-07-05_09e32087a62cd048ef05f6a553fe76bd_glassworm_qnapcrypt
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	2026-07-05_09e32087a62cd048ef05f6a553fe76bd_glassworm_qnapcrypt
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us	2026-07-05_09e32087a62cd048ef05f6a553fe76bd_glassworm_qnapcrypt

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/mountinfo	2026-07-05_09e32087a62cd048ef05f6a553fe76bd_glassworm_qnapcrypt
File opened for reading	/proc/self/cgroup	2026-07-05_09e32087a62cd048ef05f6a553fe76bd_glassworm_qnapcrypt

/tmp/2026-07-05_09e32087a62cd048ef05f6a553fe76bd_glassworm_qnapcrypt
/tmp/2026-07-05_09e32087a62cd048ef05f6a553fe76bd_glassworm_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads