Extracted

• • Target
    2026-08-02_c32a39a21d8779809f4be677d73ea75f_glassworm_qnapcrypt
  • Size 1.9MB
  • SHA256 d7135fff4e4d3af4fd159461aa1839669fa6f7fcb00092839739e08cd2e1bb24
  • MD5 c32a39a21d8779809f4be677d73ea75f
  • SHA1 65d1d834c2b3b70f981bdb318bf6a3c968bac1e7
  • SHA512 a06b76c186f1416bc0a4f3c00ce43e33c4fe5c1e36eacf69b23e90d12c24f6dd94b0d88f0ab719744efb2077db0e7d2ce4d76908a91905e09dda5b46b3a12f82
  • SSDEEP 49152:rpYB6YZmn85yMmrb/TivO90d7HjmAFd4A64nsfJkE7X7ADP/82B+g2vUqHOzQz1:O+K/bL
  • TLSH
    T1B0953947BC9155AAC0AAE235C9664252BB60BC891F3163D73F10B3F82F32BD45E79358
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionkaijipersistenceprivilege_escalation

  • Family: Kaiji

    Kaiji is a multi-functional malware written Golang.

    botnetkaiji

  • Kaiji

    Kaiji payload

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence

  • Modifies Bash startup script

    persistence
  behavioral1