6ed5df7e8fe80e5cf26d256cb3f7076165447cbcd79ad580cac3a6d434024e14

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
30/07/2026, 22:28

Target
2026-07-30_664b6a5140eb3d4fdcabd29911fe4550_glassworm_qnapcrypt
Size 1.8MB
Sample260730-2dyktsycmd
SHA256 6ed5df7e8fe80e5cf26d256cb3f7076165447cbcd79ad580cac3a6d434024e14
MD5 664b6a5140eb3d4fdcabd29911fe4550
SHA1 c97852f35c8f2ea7411a2070af5b9c5f83ac2366
SHA512 af4502132f0094974780474c5ecfa71804878d5a3db34a8ad647a0200d22d708d5ac86ded1fe19f1e7172c03a21da0f1296f618bb13f21c70f85fdb4b22c64f2
SSDEEP 24576:45TxgyOMx9CcXaNzrT/KkX2WZIkYYbH9NDpIfmVrmpEpUBJ17F+zwm7INvabOK6/:46OYpQfmY+CdNva1v8D1
TLSH
T137851950FDCB58B2D5071A3154ABA2AF27316D054F20EBC7E644BE6EED3B6D5083321A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-07-30_664b6a5140eb3d4fdcabd29911fe4550_glassworm_qnapcrypt

/tmp/2026-07-30_664b6a5140eb3d4fdcabd29911fe4550_glassworm_qnapcrypt
/tmp/2026-07-30_664b6a5140eb3d4fdcabd29911fe4550_glassworm_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
PID:1478

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact