85be7f24dfa80c4dab508f04e78ea36e6688291887f8c26324531f4bd5c5d02a

Analysis

max time kernel
30s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
04/08/2026, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_e28e4415c340290d45f3f972bb931481_glassworm_qnapcrypt
Size 2.8MB
Sample260804-12hc3seq81
SHA256 85be7f24dfa80c4dab508f04e78ea36e6688291887f8c26324531f4bd5c5d02a
MD5 e28e4415c340290d45f3f972bb931481
SHA1 3c8cb096381d61d883b290b276ad933663f5a8b6
SHA512 6e24e0b85cadd363f601a426f855f2789ab65496533c371a353eaef222dd06ad83e88c3f6bec6a596bc943038e134aa64dbb1a52cb815b9d8b8c71b86c227302
SSDEEP 49152:7bSgHkn0ONtjTsc4U+Yk/aNuXQShh0CeAi2Ht0IUBm:7ZErOXxJ/iCp0m
TLSH
T14AD57B17FCA549A5C0AAA2318A729552BBB1BC491F2023D73FA0F73C2F72BD05979744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-08-04_e28e4415c340290d45f3f972bb931481_glassworm_qnapcrypt

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/pkg_scanner_830931134/manifest.json	2026-08-04_e28e4415c340290d45f3f972bb931481_glassworm_qnapcrypt
File opened for modification	/tmp/pkg_scanner_830931134/package/attacklm-0.6.2-py3-none-any.whl	2026-08-04_e28e4415c340290d45f3f972bb931481_glassworm_qnapcrypt

/tmp/2026-08-04_e28e4415c340290d45f3f972bb931481_glassworm_qnapcrypt
/tmp/2026-08-04_e28e4415c340290d45f3f972bb931481_glassworm_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:1478
- /usr/bin/python3
  python3 --version
  2⤵
  PID:1484
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check /tmp/pkg_scanner_830931134/package/attacklm-0.6.2-py3-none-any.whl
  2⤵
  PID:1485
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check --no-deps /tmp/pkg_scanner_830931134/package/attacklm-0.6.2-py3-none-any.whl
  2⤵
  PID:1488
- /usr/bin/python3
  /usr/bin/python3 -c "import attacklm"
  2⤵
  PID:1489
- /usr/bin/python3
  /usr/bin/python3 -c " import sys, types from importlib.abc import MetaPathFinder, Loader from importlib.machinery import ModuleSpec class _AnyMeta(type): def __getattr__(cls, n): return _Any def __getitem__(cls, k): return _Any class _Any(metaclass=_AnyMeta): def __init__(self, *a, **k): pass def __getattr__(self, n): return _Any def __setattr__(self, n, v): pass def __getitem__(self, k): return _Any def __call__(self, *a, **k): return _Any() def __iter__(self): return iter(()) class _StubLoader(Loader): def create_module(self, spec): m = types.ModuleType(spec.name) m.__path__ = [] m.__getattr__ = lambda n: _Any return m def exec_module(self, m): pass class _StubFinder(MetaPathFinder): def find_spec(self, name, path=None, target=None): return ModuleSpec(name, _StubLoader()) sys.meta_path.append(_StubFinder()) import attacklm "
  2⤵
  PID:1490

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path /tmp/pkg_scanner_830931134/manifest.json
Size 181B
SHA256 b1d24b4f1a73e6c04f1e1bdfe7e7969bc208b52a77ea82a2688d6a1575373b7c
MD5 190d750334c09aa6b979094093008394
SHA1 9544cbdcb9eb7c0153823696a6871674f1a78c2e
SHA512 4984ba0d34aa564250296444365aeb9f33079eeb0a31403df81200284b0e50127a92995151a67cca70424889c60117d52737d453d10e3aebabfee716a61f9acd
TLSH
T142C012308228D79325C0DE8020B81013BA9EEC33A4D02EE6F2826D1409998AAA06338F
MD5 SHA1 SHA512 TLSH

Submit Download

attacklm-0.6.2-py3-none-any.whl

Path /tmp/pkg_scanner_830931134/package/attacklm-0.6.2-py3-none-any.whl
Size 568KB
SHA256 a82116cf3cacef72a0390289af061248e9551c80258efeae1bace327cd5351f4
MD5 2a15898ee6df1e75b6b82515d47694c9
SHA1 f51080e064ac9f819891eced0b83b613d8f7ae16
SHA512 ba85da6e8c8832265f40b0611d818121049336ea29ca8df54039e61b30da8a023b61d3cb71fa19167fe1bcac327533b70724f4a3b54cf6f630c5762d5455d90f
SSDEEP 12288:MYNYU7JO+wrRuOU2lcsq7VU0rK6d33w0bUbQ6FKudWRRk6K4AtVD1JbqOMesI2k:TNYMO/FuOYsq20r5d3fbUARk6K4An5hv
TLSH
T18FC42330B8204931E8C6EB3DB7F5BC09655FCB132826E2269D80458679479ED5F0EBE3
MD5 SHA1 SHA512 SSDEEP TLSH