Overview

overview

10

Static

static

10

2026-08-02...pcrypt

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    02/08/2026, 02:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_c32a39a21d8779809f4be677d73ea75f_glassworm_qnapcrypt
  • Size 1.9MB
  • Sample260802-c5aweaca83
  • SHA256 d7135fff4e4d3af4fd159461aa1839669fa6f7fcb00092839739e08cd2e1bb24
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
botnetdefense_evasiondiscoveryexecutionkaijipersistenceprivilege_escalation

Malware Config

Extracted

Family

  • kaiji

C2

  • 45.207.222.15:888

Signatures

  • Family: Kaiji

    Kaiji is a multi-functional malware written Golang.

    botnetkaiji
  • Kaiji 1 IoCs

    Kaiji payload

  • Executes dropped EXE 5 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 3 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 34 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Write file to user bin folder 4 IoCs
    persistence
  • Modifies Bash startup script 2 TTPs 3 IoCs
    persistence
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

    Execute scripts via Unix Shell.

    execution
  • Enumerates kernel/hardware configuration 1 TTPs 6 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/2026-08-02_c32a39a21d8779809f4be677d73ea75f_glassworm_qnapcrypt
    /tmp/2026-08-02_c32a39a21d8779809f4be677d73ea75f_glassworm_qnapcrypt
    1⤵
    • Enumerates kernel/hardware configuration
    PID:1488
    • /tmp/2026-08-02_c32a39a21d8779809f4be677d73ea75f_glassworm_qnapcrypt
      /tmp/2026-08-02_c32a39a21d8779809f4be677d73ea75f_glassworm_qnapcrypt " "
      2⤵
      • Modifies Watchdog functionality
      • Creates/modifies environment variables
      • Modifies init.d
      • Write file to user bin folder
      • Modifies Bash startup script
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:1492
      • /bin/sh
        /bin/sh -c "/etc/32676&"
        3⤵
        • Executes dropped EXE
        • Command and Scripting Interpreter: Unix Shell
        PID:1500
      • /usr/sbin/service
        service crond start
        3⤵
          PID:1502
          • /usr/bin/basename
            basename /usr/sbin/service
            4⤵
              PID:1504
            • /usr/bin/basename
              basename /usr/sbin/service
              4⤵
                PID:1505
              • /bin/systemctl
                systemctl --quiet is-active multi-user.target
                4⤵
                • Reads runtime system information
                PID:1506
              • /bin/sed
                sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                4⤵
                • Reads runtime system information
                PID:1512
              • /bin/systemctl
                systemctl list-unit-files --full "--type=socket"
                4⤵
                  PID:1511
                • /bin/systemctl
                  systemctl -p Triggers show acpid.socket
                  4⤵
                    PID:1514
                  • /bin/systemctl
                    systemctl -p Triggers show apport-forward.socket
                    4⤵
                    • Reads runtime system information
                    PID:1515
                  • /bin/systemctl
                    systemctl -p Triggers show avahi-daemon.socket
                    4⤵
                    • Reads runtime system information
                    PID:1516
                  • /bin/systemctl
                    systemctl -p Triggers show cups.socket
                    4⤵
                    • Reads runtime system information
                    PID:1517
                  • /bin/systemctl
                    systemctl -p Triggers show dbus.socket
                    4⤵
                      PID:1518
                    • /bin/systemctl
                      systemctl -p Triggers show saned.socket
                      4⤵
                      • Reads runtime system information
                      PID:1519
                    • /bin/systemctl
                      systemctl -p Triggers show snapd.socket
                      4⤵
                        PID:1520
                      • /bin/systemctl
                        systemctl -p Triggers show ssh.socket
                        4⤵
                        • Reads runtime system information
                        PID:1521
                      • /bin/systemctl
                        systemctl -p Triggers show syslog.socket
                        4⤵
                        • Reads runtime system information
                        PID:1522
                      • /bin/systemctl
                        systemctl -p Triggers show systemd-fsckd.socket
                        4⤵
                          PID:1523
                        • /bin/systemctl
                          systemctl -p Triggers show systemd-initctl.socket
                          4⤵
                            PID:1524
                          • /bin/systemctl
                            systemctl -p Triggers show systemd-journald-audit.socket
                            4⤵
                              PID:1525
                            • /bin/systemctl
                              systemctl -p Triggers show systemd-journald-dev-log.socket
                              4⤵
                                PID:1526
                              • /bin/systemctl
                                systemctl -p Triggers show systemd-journald.socket
                                4⤵
                                  PID:1527
                                • /bin/systemctl
                                  systemctl -p Triggers show systemd-networkd.socket
                                  4⤵
                                  • Reads runtime system information
                                  PID:1528
                                • /bin/systemctl
                                  systemctl -p Triggers show systemd-rfkill.socket
                                  4⤵
                                  • Reads runtime system information
                                  PID:1529
                                • /bin/systemctl
                                  systemctl -p Triggers show systemd-udevd-control.socket
                                  4⤵
                                  • Reads runtime system information
                                  PID:1530
                                • /bin/systemctl
                                  systemctl -p Triggers show systemd-udevd-kernel.socket
                                  4⤵
                                  • Reads runtime system information
                                  PID:1531
                                • /bin/systemctl
                                  systemctl -p Triggers show uuidd.socket
                                  4⤵
                                  • Reads runtime system information
                                  PID:1532
                              • /usr/local/sbin/systemctl
                                systemctl start crond.service
                                3⤵
                                  PID:1502
                                • /usr/local/bin/systemctl
                                  systemctl start crond.service
                                  3⤵
                                    PID:1502
                                  • /usr/sbin/systemctl
                                    systemctl start crond.service
                                    3⤵
                                      PID:1502
                                    • /usr/bin/systemctl
                                      systemctl start crond.service
                                      3⤵
                                        PID:1502
                                      • /sbin/systemctl
                                        systemctl start crond.service
                                        3⤵
                                          PID:1502
                                        • /bin/systemctl
                                          systemctl start crond.service
                                          3⤵
                                          • Reads runtime system information
                                          PID:1502
                                        • /bin/sh
                                          /bin/sh -c "echo \"*/1 * * * * root /.mod \" >> /etc/crontab"
                                          3⤵
                                          • Creates/modifies Cron job
                                          • Command and Scripting Interpreter: Unix Shell
                                          PID:1533
                                        • /usr/bin/renice
                                          renice -20 1492
                                          3⤵
                                            PID:1534
                                          • /bin/mount
                                            mount -o bind /tmp/ /proc/1492
                                            3⤵
                                              PID:1535
                                            • /usr/sbin/service
                                              service cron start
                                              3⤵
                                                PID:1537
                                                • /usr/bin/basename
                                                  basename /usr/sbin/service
                                                  4⤵
                                                    PID:1538
                                                  • /usr/bin/basename
                                                    basename /usr/sbin/service
                                                    4⤵
                                                      PID:1539
                                                    • /bin/systemctl
                                                      systemctl --quiet is-active multi-user.target
                                                      4⤵
                                                        PID:1540
                                                      • /bin/sed
                                                        sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
                                                        4⤵
                                                          PID:1543
                                                        • /bin/systemctl
                                                          systemctl list-unit-files --full "--type=socket"
                                                          4⤵
                                                            PID:1542
                                                          • /bin/systemctl
                                                            systemctl -p Triggers show acpid.socket
                                                            4⤵
                                                            • Reads runtime system information
                                                            PID:1544
                                                          • /bin/systemctl
                                                            systemctl -p Triggers show apport-forward.socket
                                                            4⤵
                                                              PID:1545
                                                            • /bin/systemctl
                                                              systemctl -p Triggers show avahi-daemon.socket
                                                              4⤵
                                                                PID:1546
                                                              • /bin/systemctl
                                                                systemctl -p Triggers show cups.socket
                                                                4⤵
                                                                • Reads runtime system information
                                                                PID:1547
                                                              • /bin/systemctl
                                                                systemctl -p Triggers show dbus.socket
                                                                4⤵
                                                                  PID:1548
                                                                • /bin/systemctl
                                                                  systemctl -p Triggers show saned.socket
                                                                  4⤵
                                                                  • Reads runtime system information
                                                                  PID:1549
                                                                • /bin/systemctl
                                                                  systemctl -p Triggers show snapd.socket
                                                                  4⤵
                                                                  • Reads runtime system information
                                                                  PID:1550
                                                                • /bin/systemctl
                                                                  systemctl -p Triggers show ssh.socket
                                                                  4⤵
                                                                    PID:1551
                                                                  • /bin/systemctl
                                                                    systemctl -p Triggers show syslog.socket
                                                                    4⤵
                                                                    • Reads runtime system information
                                                                    PID:1552
                                                                  • /bin/systemctl
                                                                    systemctl -p Triggers show systemd-fsckd.socket
                                                                    4⤵
                                                                      PID:1553
                                                                    • /bin/systemctl
                                                                      systemctl -p Triggers show systemd-initctl.socket
                                                                      4⤵
                                                                      • Reads runtime system information
                                                                      PID:1554
                                                                    • /bin/systemctl
                                                                      systemctl -p Triggers show systemd-journald-audit.socket
                                                                      4⤵
                                                                        PID:1555
                                                                      • /bin/systemctl
                                                                        systemctl -p Triggers show systemd-journald-dev-log.socket
                                                                        4⤵
                                                                        • Reads runtime system information
                                                                        PID:1556
                                                                      • /bin/systemctl
                                                                        systemctl -p Triggers show systemd-journald.socket
                                                                        4⤵
                                                                        • Reads runtime system information
                                                                        PID:1557
                                                                      • /bin/systemctl
                                                                        systemctl -p Triggers show systemd-networkd.socket
                                                                        4⤵
                                                                        • Reads runtime system information
                                                                        PID:1558
                                                                      • /bin/systemctl
                                                                        systemctl -p Triggers show systemd-rfkill.socket
                                                                        4⤵
                                                                        • Reads runtime system information
                                                                        PID:1559
                                                                      • /bin/systemctl
                                                                        systemctl -p Triggers show systemd-udevd-control.socket
                                                                        4⤵
                                                                        • Reads runtime system information
                                                                        PID:1560
                                                                      • /bin/systemctl
                                                                        systemctl -p Triggers show systemd-udevd-kernel.socket
                                                                        4⤵
                                                                          PID:1561
                                                                        • /bin/systemctl
                                                                          systemctl -p Triggers show uuidd.socket
                                                                          4⤵
                                                                            PID:1562
                                                                        • /usr/local/sbin/systemctl
                                                                          systemctl start cron.service
                                                                          3⤵
                                                                            PID:1537
                                                                          • /usr/local/bin/systemctl
                                                                            systemctl start cron.service
                                                                            3⤵
                                                                              PID:1537
                                                                            • /usr/sbin/systemctl
                                                                              systemctl start cron.service
                                                                              3⤵
                                                                                PID:1537
                                                                              • /usr/bin/systemctl
                                                                                systemctl start cron.service
                                                                                3⤵
                                                                                  PID:1537
                                                                                • /sbin/systemctl
                                                                                  systemctl start cron.service
                                                                                  3⤵
                                                                                    PID:1537
                                                                                  • /bin/systemctl
                                                                                    systemctl start cron.service
                                                                                    3⤵
                                                                                    • Reads runtime system information
                                                                                    PID:1537
                                                                                  • /bin/systemctl
                                                                                    systemctl start crond.service
                                                                                    3⤵
                                                                                      PID:1563
                                                                                • /etc/32676
                                                                                  /etc/32676
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:1501
                                                                                  • /bin/sleep
                                                                                    sleep 60
                                                                                    2⤵
                                                                                      PID:1503
                                                                                    • /etc/opt.services.cfg
                                                                                      /etc/opt.services.cfg
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      • Enumerates kernel/hardware configuration
                                                                                      PID:1581
                                                                                      • /etc/opt.services.cfg
                                                                                        /etc/opt.services.cfg " "
                                                                                        3⤵
                                                                                        • Enumerates kernel/hardware configuration
                                                                                        PID:1585
                                                                                    • /bin/sleep
                                                                                      sleep 60
                                                                                      2⤵
                                                                                        PID:1586
                                                                                      • /etc/opt.services.cfg
                                                                                        /etc/opt.services.cfg
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        • Enumerates kernel/hardware configuration
                                                                                        PID:1601
                                                                                        • /etc/opt.services.cfg
                                                                                          /etc/opt.services.cfg " "
                                                                                          3⤵
                                                                                          • Enumerates kernel/hardware configuration
                                                                                          PID:1605
                                                                                      • /bin/sleep
                                                                                        sleep 60
                                                                                        2⤵
                                                                                          PID:1606

                                                                                      Network

                                                                                            MITRE ATT&CK Enterprise v16

                                                                                            Reconnaissance

                                                                                            Resource Development

                                                                                            Initial Access

                                                                                            Execution

                                                                                            Command and Scripting Interpreter

                                                                                            1
                                                                                            T1059

                                                                                            Unix Shell

                                                                                            1
                                                                                            T1059.004

                                                                                            Scheduled Task/Job

                                                                                            1
                                                                                            T1053

                                                                                            Cron

                                                                                            1
                                                                                            T1053.003

                                                                                            Persistence

                                                                                            Boot or Logon Autostart Execution

                                                                                            2
                                                                                            T1547

                                                                                            Boot or Logon Initialization Scripts

                                                                                            1
                                                                                            T1037

                                                                                            RC Scripts

                                                                                            1
                                                                                            T1037.004

                                                                                            Event Triggered Execution

                                                                                            1
                                                                                            T1546

                                                                                            Unix Shell Configuration Modification

                                                                                            1
                                                                                            T1546.004

                                                                                            Hijack Execution Flow

                                                                                            1
                                                                                            T1574

                                                                                            Path Interception by PATH Environment Variable

                                                                                            1
                                                                                            T1574.007

                                                                                            Scheduled Task/Job

                                                                                            1
                                                                                            T1053

                                                                                            Cron

                                                                                            1
                                                                                            T1053.003

                                                                                            Privilege Escalation

                                                                                            Boot or Logon Autostart Execution

                                                                                            2
                                                                                            T1547

                                                                                            Boot or Logon Initialization Scripts

                                                                                            1
                                                                                            T1037

                                                                                            RC Scripts

                                                                                            1
                                                                                            T1037.004

                                                                                            Event Triggered Execution

                                                                                            1
                                                                                            T1546

                                                                                            Unix Shell Configuration Modification

                                                                                            1
                                                                                            T1546.004

                                                                                            Hijack Execution Flow

                                                                                            1
                                                                                            T1574

                                                                                            Path Interception by PATH Environment Variable

                                                                                            1
                                                                                            T1574.007

                                                                                            Scheduled Task/Job

                                                                                            1
                                                                                            T1053

                                                                                            Cron

                                                                                            1
                                                                                            T1053.003

                                                                                            Defense Evasion

                                                                                            Hijack Execution Flow

                                                                                            1
                                                                                            T1574

                                                                                            Path Interception by PATH Environment Variable

                                                                                            1
                                                                                            T1574.007

                                                                                            Impair Defenses

                                                                                            1
                                                                                            T1562

                                                                                            Credential Access

                                                                                            Discovery

                                                                                            System Information Discovery

                                                                                            1
                                                                                            T1082

                                                                                            Lateral Movement

                                                                                            Collection

                                                                                            Command and Control

                                                                                            Exfiltration

                                                                                            Impact

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            .mod
                                                                                            • Path /.mod
                                                                                            • Size 34B
                                                                                            • SHA256 6ab64e727571458d4884fb2fe82c27c467db0699cb8f648b3f0217c35d2b7511
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            .walk
                                                                                            • Path /etc/.walk
                                                                                            • Size 49B
                                                                                            • SHA256 8b552782379b7888a4b5e48ce7ead066d48b1fa151cf74a9ed13f39ab3102e51
                                                                                            • MD5 SHA1 SHA512
                                                                                            Submit Download

                                                                                            .walk
                                                                                            • Path /etc/.walk
                                                                                            • Size 98B
                                                                                            • SHA256 ec130678829d1aca3a38a1de2e0826ad0608d00768917e2ec29dfec9d0c2a618
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            32676
                                                                                            • Path /etc/32676
                                                                                            • Size 61B
                                                                                            • SHA256 b7ce294613dd2c237a4a50548bfcd5c14d166107f2d2e965499bc78695300d5b
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            opt.services.cfg
                                                                                            • Path /etc/opt.services.cfg
                                                                                            • Size 1.9MB
                                                                                            • SHA256 d7135fff4e4d3af4fd159461aa1839669fa6f7fcb00092839739e08cd2e1bb24
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            gateway.sh
                                                                                            • Path /etc/profile.d/gateway.sh
                                                                                            • Size 1KB
                                                                                            • SHA256 8964865a4a5f95a2c4ea611529f2a5d8e9b44e19b67682a8f818bb92caf9f0af
                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                            Submit Download

                                                                                            find
                                                                                            • Path /usr/bin/include/find
                                                                                            • Size 232KB
                                                                                            • SHA256 189fbf2416c8205430d8eaa85e2947bc15504ca335ad4a77ec668ff3cbf9c84a
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download

                                                                                            lsof
                                                                                            • Path /usr/bin/include/lsof
                                                                                            • Size 159KB
                                                                                            • SHA256 1190f4dbc7be174de8fd4096c9bf7a28eebfac937d308b7cc533be4a1240d26e
                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                            Submit Download