3e2c3f60918850764ae723cc84df83b4804c95e2295d3361463ff97bf7558864

Analysis

max time kernel
30s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
04/08/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_42edcf2d1b4f356fa22d366f82e45b5f_glassworm_qnapcrypt
Size 2.8MB
Sample260804-23av3aserb
SHA256 3e2c3f60918850764ae723cc84df83b4804c95e2295d3361463ff97bf7558864
MD5 42edcf2d1b4f356fa22d366f82e45b5f
SHA1 e9507e575bafd54bff858872b2f7c898672d10d8
SHA512 edfb53c53791e18bebb28c8d73382d29b5d5613eedf224951c82612214788663e68fbe26281693585e7c4ffb1e8537d8ad4dfd0ff34b8af5b3e15a94f4a442f8
SSDEEP 49152:7bSgHkn0ONtjTsc4U+Yk/awuXQShJzTQto4M2I4:7ZErPXxtT2ojp4
TLSH
T1A6D56B17FCA549A5C0AAA2318A729552BBB1BC491F2023D73FA0F73C2F72BD05979744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-08-04_42edcf2d1b4f356fa22d366f82e45b5f_glassworm_qnapcrypt

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/pkg_scanner_1449735065/manifest.json	2026-08-04_42edcf2d1b4f356fa22d366f82e45b5f_glassworm_qnapcrypt
File opened for modification	/tmp/pkg_scanner_1449735065/package/attacklm-0.6.5-py3-none-any.whl	2026-08-04_42edcf2d1b4f356fa22d366f82e45b5f_glassworm_qnapcrypt

/tmp/2026-08-04_42edcf2d1b4f356fa22d366f82e45b5f_glassworm_qnapcrypt
/tmp/2026-08-04_42edcf2d1b4f356fa22d366f82e45b5f_glassworm_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:1492
- /usr/bin/python3
  python3 --version
  2⤵
  PID:1497
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check /tmp/pkg_scanner_1449735065/package/attacklm-0.6.5-py3-none-any.whl
  2⤵
  PID:1498
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check --no-deps /tmp/pkg_scanner_1449735065/package/attacklm-0.6.5-py3-none-any.whl
  2⤵
  PID:1500
- /usr/bin/python3
  /usr/bin/python3 -c "import attacklm"
  2⤵
  PID:1505
- /usr/bin/python3
  /usr/bin/python3 -c " import sys, types from importlib.abc import MetaPathFinder, Loader from importlib.machinery import ModuleSpec class _AnyMeta(type): def __getattr__(cls, n): return _Any def __getitem__(cls, k): return _Any class _Any(metaclass=_AnyMeta): def __init__(self, *a, **k): pass def __getattr__(self, n): return _Any def __setattr__(self, n, v): pass def __getitem__(self, k): return _Any def __call__(self, *a, **k): return _Any() def __iter__(self): return iter(()) class _StubLoader(Loader): def create_module(self, spec): m = types.ModuleType(spec.name) m.__path__ = [] m.__getattr__ = lambda n: _Any return m def exec_module(self, m): pass class _StubFinder(MetaPathFinder): def find_spec(self, name, path=None, target=None): return ModuleSpec(name, _StubLoader()) sys.meta_path.append(_StubFinder()) import attacklm "
  2⤵
  PID:1506

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path /tmp/pkg_scanner_1449735065/manifest.json
Size 181B
SHA256 7dd2a7f44480f8674298d0b5a9ac003d5831fd35d91223d471a5134fe5252351
MD5 ae20ba729ee6b95fceb9e02a40a224db
SHA1 6332de55797e02888874781446d28a3888b6da57
SHA512 fbfc68153c041ee27eea9ca7dd5372ccfa8a768f1052492c775550433433e9ea61663e5a6edfb5e4c864e65a28f8b574a01a4ddd41df2d56e6f3129479815611
TLSH
T1A4C012309228CA9355C0DE9020B80013AA9EEC23A4D02EE6F2827D040A9986AA07338E
MD5 SHA1 SHA512 TLSH

Submit Download

attacklm-0.6.5-py3-none-any.whl

Path /tmp/pkg_scanner_1449735065/package/attacklm-0.6.5-py3-none-any.whl
Size 569KB
SHA256 6be53c657561ecd9310784a070bb5a5d35e61592cda7274846e351dad28a5bfa
MD5 8bdcfb5b2238908e67bc99056819adc4
SHA1 f9cd01cefffad63da19e119d8532b7109f536ff4
SHA512 acee84f13d3d8a081aa455ed7c563f7267fbc108e0bbadbc0173694c4a5163ec2f305f996ef388d9f71a40d40570142aacf6ad0c37995b13d0326e5bbbe722c3
SSDEEP 12288:iYNYU7JO+wrRuOU2lcsq7VU0DK6d33w0bUbQ6FKudWRRk6K4AtVD1JbqwtCI6V:hNYMO/FuOYsq20D5d3fbUARk6K4An5hu
TLSH
T1F8C42371BD284970E4DBEF34BBF9B81C256ECF532826E1255B80844675824BD5F0FBA2
MD5 SHA1 SHA512 SSDEEP TLSH