General
- Target 2026-08-04_bd26cb472ba1723bfbf67260176349f5_glassworm_gognt_poet-rat_qnapcrypt_rex_zxxz
- Size 8.2MB
- Sample260804-gbttmsgn9v
- SHA256 e0cb964552279df8b23fd6b6127b7efd2498e5f770b5e1a022da262e0334654b
- MD5 bd26cb472ba1723bfbf67260176349f5
- SHA1 11a856121145e92221757b9fbf784620caf31976
- SHA512 c7487a04013bbf1e0a92a8d132a64857e18b79bcb94152a006b80a2121624b3d4e204b2de539bcf6795f0a4712f74f848d0a7b3f6508a98bd2d05a9c03d5b846
- SSDEEP 98304:8bQUVZFz/Mg7nht3QFL9eKyBi1y8eiUlOX:InFTMyn/3QjWl
- TLSH T16F864B1BF8A614D6C2FEE1708A965222BF7134A5C33137D76F9086951B66FE4B93E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-04_bd26cb472ba1723bfbf67260176349f5_glassworm_gognt_poet-rat_qnapcrypt_rex_zxxz
Resource
ubuntu1804-amd64-20260513-en
5 signatures
150 seconds
Malware Config
Extracted
Family
-
stealthworker
Version
-
0.08
C2
-
http://qomojo.com:1313
Targets
-
- Target 2026-08-04_bd26cb472ba1723bfbf67260176349f5_glassworm_gognt_poet-rat_qnapcrypt_rex_zxxz
- Size 8.2MB
- SHA256 e0cb964552279df8b23fd6b6127b7efd2498e5f770b5e1a022da262e0334654b
- MD5 bd26cb472ba1723bfbf67260176349f5
- SHA1 11a856121145e92221757b9fbf784620caf31976
- SHA512 c7487a04013bbf1e0a92a8d132a64857e18b79bcb94152a006b80a2121624b3d4e204b2de539bcf6795f0a4712f74f848d0a7b3f6508a98bd2d05a9c03d5b846
- SSDEEP 98304:8bQUVZFz/Mg7nht3QFL9eKyBi1y8eiUlOX:InFTMyn/3QjWl
- TLSH T16F864B1BF8A614D6C2FEE1708A965222BF7134A5C33137D76F9086951B66FE4B93E300
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.