7e6c30d65fedbc1c1c45270f010bee0037f7d07625de5067b1a76d0cba0d9129

Analysis

max time kernel
30s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
30/07/2026, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_b93f299497dc3ab1acf5ac562b193ec2_glassworm_qnapcrypt
Size 4.2MB
Sample260730-dg962axhrf
SHA256 7e6c30d65fedbc1c1c45270f010bee0037f7d07625de5067b1a76d0cba0d9129
MD5 b93f299497dc3ab1acf5ac562b193ec2
SHA1 420695ad99ce665207ec68131e837dd6eb900f40
SHA512 cd05c1b10b24638fcf731fb4f1fe2bf97588daa1a62c1f3cc7034fef7633ae517e689ad22f434bf3fb69af78d9b7b311d95be764f3670359733f6e0e2f2b764e
SSDEEP 49152:7bSgHkn0ONtjTsc4U+Yk/afohGYvSj16M/yeQlfIUyb1BY1ieTttXvIHjS:7ZErRoNvXeQlfIUmcieTXfIHjS
TLSH
T12D16BE17FCA549A5C0AEA2318A729552BBB1BC491F2023D73FA0F7382F76BD05979704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-07-30_b93f299497dc3ab1acf5ac562b193ec2_glassworm_qnapcrypt

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/pkg_scanner_3153923614/manifest.json	2026-07-30_b93f299497dc3ab1acf5ac562b193ec2_glassworm_qnapcrypt
File opened for modification	/tmp/pkg_scanner_3153923614/package/bingo_ai-3.2.89-py3-none-any.whl	2026-07-30_b93f299497dc3ab1acf5ac562b193ec2_glassworm_qnapcrypt

/tmp/2026-07-30_b93f299497dc3ab1acf5ac562b193ec2_glassworm_qnapcrypt
/tmp/2026-07-30_b93f299497dc3ab1acf5ac562b193ec2_glassworm_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:1486
- /usr/bin/python3
  python3 --version
  2⤵
  PID:1493
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check /tmp/pkg_scanner_3153923614/package/bingo_ai-3.2.89-py3-none-any.whl
  2⤵
  PID:1495
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check --no-deps /tmp/pkg_scanner_3153923614/package/bingo_ai-3.2.89-py3-none-any.whl
  2⤵
  PID:1496
- /usr/bin/python3
  /usr/bin/python3 -c "import bingo"
  2⤵
  PID:1497
- /usr/bin/python3
  /usr/bin/python3 -c " import sys, types from importlib.abc import MetaPathFinder, Loader from importlib.machinery import ModuleSpec class _AnyMeta(type): def __getattr__(cls, n): return _Any def __getitem__(cls, k): return _Any class _Any(metaclass=_AnyMeta): def __init__(self, *a, **k): pass def __getattr__(self, n): return _Any def __setattr__(self, n, v): pass def __getitem__(self, k): return _Any def __call__(self, *a, **k): return _Any() def __iter__(self): return iter(()) class _StubLoader(Loader): def create_module(self, spec): m = types.ModuleType(spec.name) m.__path__ = [] m.__getattr__ = lambda n: _Any return m def exec_module(self, m): pass class _StubFinder(MetaPathFinder): def find_spec(self, name, path=None, target=None): return ModuleSpec(name, _StubLoader()) sys.meta_path.append(_StubFinder()) import bingo "
  2⤵
  PID:1501

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path /tmp/pkg_scanner_3153923614/manifest.json
Size 180B
SHA256 503fe129f648c067e4e1d4dc6bc24eecc58ca249f6d9a8329c38567767a3f197
MD5 f575166182959e368d129a72c8777af5
SHA1 488d0880e05e99348e6470f6a81cd7433d73d7fa
SHA512 1efd3c8e381b2bf30524160d58c9a3d1ecd91bda5c406af32eb7cd88feb4d6b2989b6a705953311174e1ad2c986417231700e116b13bb5c930b31c768498cd9b
TLSH
T13EC012E00028D36332E9EE84207D681A885A6C6338C02CE0F3836E4202A9A9A806321F
MD5 SHA1 SHA512 TLSH

Submit Download

bingo_ai-3.2.89-py3-none-any.whl

Path /tmp/pkg_scanner_3153923614/package/bingo_ai-3.2.89-py3-none-any.whl
Size 1.9MB
SHA256 69d3ed0d5ecb6d7cf996164d8a3722b0b65614f51a93ee26ef2ebe4ed8946fd0
MD5 8a342f2edc8a391221a9a4bb87a99c40
SHA1 826a4cba0975368f42376bc245e42fafc3aa865e
SHA512 cd49fb769f2f3ee8462e857eed39220b6c078e5c8b7f476b142227fa2b720062c3dffd8e4c681f50433dc93d003431898895b7d7029ce64bc4d584f8556412e8
SSDEEP 49152:a5EZO6dX+DzebV8x637nagwiNSGPTgCuKNYBo6FM8bsu479X:a+ZO1z88o37BwKPruc6FT479X
TLSH
T1E2952378C8034819D239127EE5763B41824A2B37754DE49EA8B0536BF28BBDDD61F7E0
MD5 SHA1 SHA512 SSDEEP TLSH