7d1d1f73a7f34f9322dd946872bc9c77e9c76c03efd13e6ae4a613fc97cbbefd

Analysis

max time kernel
31s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
06/07/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_c9f87188e9973b3375424f50f35ef7bc_glassworm_qnapcrypt
Size 28.8MB
Sample260706-v8rx7set2p
SHA256 7d1d1f73a7f34f9322dd946872bc9c77e9c76c03efd13e6ae4a613fc97cbbefd
MD5 c9f87188e9973b3375424f50f35ef7bc
SHA1 b797b45d64598b1712f39732de48e4fdf40dd364
SHA512 2fa3717b154677acb3754485c1cd30aec406acd01c5a9c5de51d678a7fdaac922f606cd8c35b323f8bd5d38e2e7bdc5e3595f960af358b04d4bc5de6628db09d
SSDEEP 393216:7Dssk4R5N4yt3q11ljrzDk4ZqubLGS1N/wZc+8BtV1+UoSOHsc9fSfxZOmDfmNr:7jbArJLGS1Nec+8r+/sc9YxhDfu
TLSH
T135672317FCA549A5C4AEA2328A769552BBB1BC091F2063D33F50F3382F76BD05A79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-07-06_c9f87188e9973b3375424f50f35ef7bc_glassworm_qnapcrypt

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/pkg_scanner_1474373379/manifest.json	2026-07-06_c9f87188e9973b3375424f50f35ef7bc_glassworm_qnapcrypt
File opened for modification	/tmp/pkg_scanner_1474373379/package/inspect_evals-0.14.1-py3-none-any.whl	2026-07-06_c9f87188e9973b3375424f50f35ef7bc_glassworm_qnapcrypt

/tmp/2026-07-06_c9f87188e9973b3375424f50f35ef7bc_glassworm_qnapcrypt
/tmp/2026-07-06_c9f87188e9973b3375424f50f35ef7bc_glassworm_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:1480
- /usr/bin/python3
  python3 --version
  2⤵
  PID:1491
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check /tmp/pkg_scanner_1474373379/package/inspect_evals-0.14.1-py3-none-any.whl
  2⤵
  PID:1492
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check --no-deps /tmp/pkg_scanner_1474373379/package/inspect_evals-0.14.1-py3-none-any.whl
  2⤵
  PID:1493
- /usr/bin/python3
  /usr/bin/python3 -c "import inspect_evals"
  2⤵
  PID:1494
- /usr/bin/python3
  /usr/bin/python3 -c " import sys, types from importlib.abc import MetaPathFinder, Loader from importlib.machinery import ModuleSpec class _AnyMeta(type): def __getattr__(cls, n): return _Any def __getitem__(cls, k): return _Any class _Any(metaclass=_AnyMeta): def __init__(self, *a, **k): pass def __getattr__(self, n): return _Any def __setattr__(self, n, v): pass def __getitem__(self, k): return _Any def __call__(self, *a, **k): return _Any() def __iter__(self): return iter(()) class _StubLoader(Loader): def create_module(self, spec): m = types.ModuleType(spec.name) m.__path__ = [] m.__getattr__ = lambda n: _Any return m def exec_module(self, m): pass class _StubFinder(MetaPathFinder): def find_spec(self, name, path=None, target=None): return ModuleSpec(name, _StubLoader()) sys.meta_path.append(_StubFinder()) import inspect_evals "
  2⤵
  PID:1495

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path /tmp/pkg_scanner_1474373379/manifest.json
Size 198B
SHA256 311daf48b7c7402623acc140fe675c2e186259557497d1316da706826ecfc40d
MD5 0ff19d037c53ff6f92aa643998840f07
SHA1 4b2f41f411b52c55fcad88558aa91461cea94fea
SHA512 03cfc2a204dcac3bced33f81186d3e308777fb9c679a754240c28cdc3bc1989680933d70b4a191be9eae58a1e623768126afc719acd67ea51958d25f29f9dc1d
TLSH
T1A0D0C960021AC66319C09F9151B85912096AAC3FBCC028C0E3A2BD0882DF95A9D5335E
MD5 SHA1 SHA512 TLSH

Submit Download

inspect_evals-0.14.1-py3-none-any.whl

Path /tmp/pkg_scanner_1474373379/package/inspect_evals-0.14.1-py3-none-any.whl
Size 27.0MB
SHA256 dec9f49b5c4d9b7dcb93c57464d4d01c9c2b70452dd7b200fa5aa21de62ef45b
MD5 e95e2bfa2de148a98bcf10c2e6a62334
SHA1 69275c2b6b8a25ba42fd0496c91e2e0d31ad4d7d
SHA512 1d389afd1351353a882cef7a0ab8d2881c3fbe402ce0a7bc72a75c98f681195d958be3ee566e0c41373319fc0c4ce5dae1b6356126249dd09279d82242aae90c
SSDEEP 393216:eyzL1Ht+TUoWLBaPDBpyn39TBAGNrh6vHGZDlkUy07N0DiM9bMfRn4MfL21A:F9aP039TBrImbkk0DbJ6RBfLF
TLSH
T1AA5733B983195BD3DD830378E1141522313C96EDFD4A392FB970D719E81FD898B8B92A
MD5 SHA1 SHA512 SSDEEP TLSH