0d9bf5ea6601769391384cdb5954004761b7e008e2fa2c47eab6fab9ab4e534d

Analysis

max time kernel
30s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
04/08/2026, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_11f3f2c0bfb8a2fab54c35b4a69d050f_glassworm_qnapcrypt
Size 2.8MB
Sample260804-3ddfbsshnc
SHA256 0d9bf5ea6601769391384cdb5954004761b7e008e2fa2c47eab6fab9ab4e534d
MD5 11f3f2c0bfb8a2fab54c35b4a69d050f
SHA1 3a7fdc674f21b44b154bf9af3eb1e29ee2a67b44
SHA512 a44c5ca834eaecb36729b7061cad6ea8256069adbbe8b19533f4f9f3b4b859646aaabf6be249e93e2147609b860cbd45455a86d5cfcda77b67e014a2d0692191
SSDEEP 49152:7bSgHkn0ONtjTsc4U+Yk/aluXQShJzTQto4M3nYIv:7ZEraXxtT2ojHv
TLSH
T1B8D56B17FCA549A5C0AAA2318A729552BBB1BC491F2023D73FA0F73C2F72BD05979744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-08-04_11f3f2c0bfb8a2fab54c35b4a69d050f_glassworm_qnapcrypt

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/pkg_scanner_2055218898/manifest.json	2026-08-04_11f3f2c0bfb8a2fab54c35b4a69d050f_glassworm_qnapcrypt
File opened for modification	/tmp/pkg_scanner_2055218898/package/attacklm-0.6.4-py3-none-any.whl	2026-08-04_11f3f2c0bfb8a2fab54c35b4a69d050f_glassworm_qnapcrypt

/tmp/2026-08-04_11f3f2c0bfb8a2fab54c35b4a69d050f_glassworm_qnapcrypt
/tmp/2026-08-04_11f3f2c0bfb8a2fab54c35b4a69d050f_glassworm_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:1481
- /usr/bin/python3
  python3 --version
  2⤵
  PID:1487
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check /tmp/pkg_scanner_2055218898/package/attacklm-0.6.4-py3-none-any.whl
  2⤵
  PID:1489
- /usr/bin/python3
  /usr/bin/python3 -m pip install --no-input --disable-pip-version-check --no-deps /tmp/pkg_scanner_2055218898/package/attacklm-0.6.4-py3-none-any.whl
  2⤵
  PID:1491
- /usr/bin/python3
  /usr/bin/python3 -c "import attacklm"
  2⤵
  PID:1495
- /usr/bin/python3
  /usr/bin/python3 -c " import sys, types from importlib.abc import MetaPathFinder, Loader from importlib.machinery import ModuleSpec class _AnyMeta(type): def __getattr__(cls, n): return _Any def __getitem__(cls, k): return _Any class _Any(metaclass=_AnyMeta): def __init__(self, *a, **k): pass def __getattr__(self, n): return _Any def __setattr__(self, n, v): pass def __getitem__(self, k): return _Any def __call__(self, *a, **k): return _Any() def __iter__(self): return iter(()) class _StubLoader(Loader): def create_module(self, spec): m = types.ModuleType(spec.name) m.__path__ = [] m.__getattr__ = lambda n: _Any return m def exec_module(self, m): pass class _StubFinder(MetaPathFinder): def find_spec(self, name, path=None, target=None): return ModuleSpec(name, _StubLoader()) sys.meta_path.append(_StubFinder()) import attacklm "
  2⤵
  PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path /tmp/pkg_scanner_2055218898/manifest.json
Size 181B
SHA256 6a128d582f5d9feb7677187b424327efafd9ff050911667c426e262c88c4536d
MD5 f2ba1b35e7f6fcf5ebd084393484735a
SHA1 72c627e6b972a6688abd8555e4db2e216d3a2479
SHA512 661f61c2ccb1e1c08745f743825be7268bf9d5cf699a78dbdd5ba1b028a410727480f427997252fd62cca019af109722684f6c04b4a4509b6e8a5fef8b7e0172
TLSH
T110C012304228C65315C0DE8110BC00136A9FDC33A4D02ED6F3426D04099D46A945334E
MD5 SHA1 SHA512 TLSH

Submit Download

attacklm-0.6.4-py3-none-any.whl

Path /tmp/pkg_scanner_2055218898/package/attacklm-0.6.4-py3-none-any.whl
Size 569KB
SHA256 a0e686acffd5f34798eb4baffbecd6f699e9fb395e3177137f112eade99e4990
MD5 38d54f5aeba14f963b1eeab24c7091a4
SHA1 68d6e6841289629a33a3a2e2661c00276ca64418
SHA512 d1a427b533937d39e3e012c7be82d453f2a3dd19775f7c6fc4a259c348c307a9d614bd80b5c6fb8cf14c9835213e6d0e73985942bdefde263757708fe56c4faf
SSDEEP 12288:+YNYU7JO+wrRuOU2lcsq7VU0DK6d33w0bUbQ6FKudWRRk6K4AtVD1JbqzY0u9YI4:NNYMO/FuOYsq20D5d3fbUARk6K4An5hC
TLSH
T1FDC42370B8244430E897FB38A6E9B808451EDF631D36D5326ED18597B5428EE5F0FBD2
MD5 SHA1 SHA512 SSDEEP TLSH