dc525aea712e005b0fe6b0e55546e347e5784fc600397e54d30eedc21ae6c739

Analysis

max time kernel
30s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
14/07/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_f031855067e3d692a05e1ca442f4b9be_glassworm_qnapcrypt
Size 4.5MB
Sample260714-tkfplaax2w
SHA256 dc525aea712e005b0fe6b0e55546e347e5784fc600397e54d30eedc21ae6c739
MD5 f031855067e3d692a05e1ca442f4b9be
SHA1 8bbd674c636d317b31668f3a1bd8dc787eb7ada7
SHA512 66b4beb26ac9b6b3a0c134a37cda4732d2e5056b45b7fc6b0ec70270edda93eef1dbf9482ce82e4441d210adb3aa97a8375f924f46d3dd4822d98c5636f32781
SSDEEP 49152:7bSgHkn0ONtjTsc4U+Yk/aGBXvqfMAPsA4K8eJRCNjCKSQa+wddoIRwZgNB65jyE:7ZEr4pOPPT8e+C5Qnw6gNo52apy4Rl2k
TLSH
T1B726BE17FCA549A5C0AAA2318A729152BBB1BC491F2023D73FA0F73C2F76BD05979744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-07-14_f031855067e3d692a05e1ca442f4b9be_glassworm_qnapcrypt

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/pkg_scanner_1204307647/manifest.json	2026-07-14_f031855067e3d692a05e1ca442f4b9be_glassworm_qnapcrypt
File opened for modification	/tmp/pkg_scanner_1204307647/package/bingo_ai-6.2.12-py3-none-any.whl	2026-07-14_f031855067e3d692a05e1ca442f4b9be_glassworm_qnapcrypt

/tmp/2026-07-14_f031855067e3d692a05e1ca442f4b9be_glassworm_qnapcrypt
/tmp/2026-07-14_f031855067e3d692a05e1ca442f4b9be_glassworm_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:1480
- /usr/bin/python3
  python3 --version
  2⤵
  PID:1484
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check /tmp/pkg_scanner_1204307647/package/bingo_ai-6.2.12-py3-none-any.whl
  2⤵
  PID:1485
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check --no-deps /tmp/pkg_scanner_1204307647/package/bingo_ai-6.2.12-py3-none-any.whl
  2⤵
  PID:1489
- /usr/bin/python3
  /usr/bin/python3 -c "import bingo"
  2⤵
  PID:1491
- /usr/bin/python3
  /usr/bin/python3 -c " import sys, types from importlib.abc import MetaPathFinder, Loader from importlib.machinery import ModuleSpec class _AnyMeta(type): def __getattr__(cls, n): return _Any def __getitem__(cls, k): return _Any class _Any(metaclass=_AnyMeta): def __init__(self, *a, **k): pass def __getattr__(self, n): return _Any def __setattr__(self, n, v): pass def __getitem__(self, k): return _Any def __call__(self, *a, **k): return _Any() def __iter__(self): return iter(()) class _StubLoader(Loader): def create_module(self, spec): m = types.ModuleType(spec.name) m.__path__ = [] m.__getattr__ = lambda n: _Any return m def exec_module(self, m): pass class _StubFinder(MetaPathFinder): def find_spec(self, name, path=None, target=None): return ModuleSpec(name, _StubLoader()) sys.meta_path.append(_StubFinder()) import bingo "
  2⤵
  PID:1495

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path /tmp/pkg_scanner_1204307647/manifest.json
Size 180B
SHA256 fcd3e3fc7c85bc01b7524333d51053df569c4d7a40de57fe9154a3462ebd2512
MD5 8ba025181a84f8259d383e69c663b7fa
SHA1 900804da2d574177d98e0f2acfa485699b761a56
SHA512 2ac2303043a4162bdf0ceecee19ef06bcd40553c071679cc74f6ba0b61a63b38078d7230fd1adff5323b8800c2a16ca7891a5924ffdc7eb38e61c38c4e434401
TLSH
T1E2C012A00028F36320E8EE842139181A481A6C23B8C038E0F2423E4006AEB62846321F
MD5 SHA1 SHA512 TLSH

Submit Download

bingo_ai-6.2.12-py3-none-any.whl

Path /tmp/pkg_scanner_1204307647/package/bingo_ai-6.2.12-py3-none-any.whl
Size 2.2MB
SHA256 346738d3ceb7cb4a799a6b7940a7d55ea0b59a1aa995fc6edbb0639b0ee319a6
MD5 ce5197633b8a96b1bc261488df5371e9
SHA1 e9d09a34073f6202ef842c51ab694e4d1c077d80
SHA512 6c7eee75168984144c67c9482f73af2e51e4e0cd4fecb6b45a7020bacbf6045edca4403b54a9c347af1c59772faef69826a620c788ab728174521aad288b959a
SSDEEP 49152:S0J3GBsAitEZOQdX+DzebV8x637nagwiNSGPTgCuKxPYB93WLFn+8b+z5JtJIH32:S0JWBRZODz88o37BwKPruU7L5Z+162
TLSH
T118B5237CC8134815D23812BDE537370A861E1A37B48DA58DF5605369FA9BBDCE22F6E0
MD5 SHA1 SHA512 SSDEEP TLSH