ab2c2e2e303ddda1f64f104b3dcf72a063a009c3180f39740455944d3d7e2eb6

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
10/07/2026, 11:21

Target
2026-07-10_f84e26d022f77f0105e759d0e5516649_glassworm_qnapcrypt
Size 2.4MB
Sample260710-nf9tzsbt21
SHA256 ab2c2e2e303ddda1f64f104b3dcf72a063a009c3180f39740455944d3d7e2eb6
MD5 f84e26d022f77f0105e759d0e5516649
SHA1 0fee5847227e2dbb6af2f33c18280a1e3b856655
SHA512 d4c4fbc140b540f27017b216bd30619caa83c9f04835e5f3d59524b90a773daac31d081094417194fae186fd54ee3a4dcf89b2868cb775db7766045e3d40a173
SSDEEP 24576:0FVBAG+DXiV3yTOKYrgKTKBnAgaHS+qicKbEp5EPvjEO+1t1I+zQMsW7:0BpiXiFyfkg2GnAFHkiJS5Qk/sM
TLSH
T138B54A17BCA546A5C0AEA23189B69652BB71BC490F3027D73F50F7382F72BD0A979704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-07-10_f84e26d022f77f0105e759d0e5516649_glassworm_qnapcrypt

/tmp/2026-07-10_f84e26d022f77f0105e759d0e5516649_glassworm_qnapcrypt
/tmp/2026-07-10_f84e26d022f77f0105e759d0e5516649_glassworm_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
PID:1492

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact