7084433ab1b36f87be914a1dc1b9f9d66eafe7cec002c7b5ca8c7de802c38dc3

General

Target
2026-07-18_4d7362efbf560a076526043349cdb437_glassworm_qnapcrypt
Size 3.7MB
Sample260718-ng577ahx7n
SHA256 7084433ab1b36f87be914a1dc1b9f9d66eafe7cec002c7b5ca8c7de802c38dc3
MD5 4d7362efbf560a076526043349cdb437
SHA1 03460a60090b5baae42bdad58dc44788fd2129b7
SHA512 9b4497eb8506716a3d6aa981e851c87f1b45c7e1457fe57d89fcb71267844225d0569f15aa672dc89781cb22542582f390936a689b01d215b14a7cd10d225d1f
SSDEEP 24576:LeedZUUBLuO2pGtXx+cbi2gW+X1+n+GYjg8e0HNAVn1WvxW9mmY19TgJruyrNm34:LPPy00lzolYIV5mo/M1cpblbxE6zv
TLSH
T1CC06BF45EDC734B5D603163648EF66DB0B2DBF072F319A83B9447BAA617749A04F222C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-07-18_4d7362efbf560a076526043349cdb437_glassworm_qnapcrypt
- Size 3.7MB
- SHA256 7084433ab1b36f87be914a1dc1b9f9d66eafe7cec002c7b5ca8c7de802c38dc3
- MD5 4d7362efbf560a076526043349cdb437
- SHA1 03460a60090b5baae42bdad58dc44788fd2129b7
- SHA512 9b4497eb8506716a3d6aa981e851c87f1b45c7e1457fe57d89fcb71267844225d0569f15aa672dc89781cb22542582f390936a689b01d215b14a7cd10d225d1f
- SSDEEP 24576:LeedZUUBLuO2pGtXx+cbi2gW+X1+n+GYjg8e0HNAVn1WvxW9mmY19TgJruyrNm34:LPPy00lzolYIV5mo/M1cpblbxE6zv
- TLSH
  T1CC06BF45EDC734B5D603163648EF66DB0B2DBF072F319A83B9447BAA617749A04F222C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm credential_access defense_evasion discovery execution privilege_escalation
- Creates Raw socket
  Creates a socket that captures raw packets at the device level
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
- Reads AppArmor ptrace settings
  Discovery of allowed ptrace capabilities by AppArmor.
  discovery
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads data from the clipboard
  Attempts to collect data stored in the clipboard using xclip tool.
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
- Reads network interface configuration
  Fetches information about one or more active network interfaces.
  discovery
- Uses Polkit to run commands
  Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.
- Virtualization/Sandbox Evasion: Time Based Evasion
  Adversaries may detect and evade virtualized environments and sandboxes.
  defense_evasion
- Reads process memory
  Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
  credential_access
behavioral1