stealthworker | 2026-08-04_bd26cb472ba1723bfbf67260176349f5_glassworm_gognt_poet-rat_qnapcrypt_rex_zxxz

General

Target
2026-08-04_bd26cb472ba1723bfbf67260176349f5_glassworm_gognt_poet-rat_qnapcrypt_rex_zxxz
Size 8.2MB
Sample260804-gbttmsgn9v
SHA256 e0cb964552279df8b23fd6b6127b7efd2498e5f770b5e1a022da262e0334654b
MD5 bd26cb472ba1723bfbf67260176349f5
SHA1 11a856121145e92221757b9fbf784620caf31976
SHA512 c7487a04013bbf1e0a92a8d132a64857e18b79bcb94152a006b80a2121624b3d4e204b2de539bcf6795f0a4712f74f848d0a7b3f6508a98bd2d05a9c03d5b846
SSDEEP 98304:8bQUVZFz/Mg7nht3QFL9eKyBi1y8eiUlOX:InFTMyn/3QjWl
TLSH
T16F864B1BF8A614D6C2FEE1708A965222BF7134A5C33137D76F9086951B66FE4B93E300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family

Version

C2

Family: StealthWorker
StealthWorker is golang-based brute force malware.
botnet stealthworker

StealthWorker payload 1 IoCs

botnet

resource	yara_rule
sample	stealthworker

2026-08-04_bd26cb472ba1723bfbf67260176349f5_glassworm_gognt_poet-rat_qnapcrypt_rex_zxxz

.elf 8.2MB

SHA256 e0cb964552279df8b23fd6b6127b7efd2498e5f770b5e1a022da262e0334654b
MD5 bd26cb472ba1723bfbf67260176349f5
SHA1 11a856121145e92221757b9fbf784620caf31976
SHA512 c7487a04013bbf1e0a92a8d132a64857e18b79bcb94152a006b80a2121624b3d4e204b2de539bcf6795f0a4712f74f848d0a7b3f6508a98bd2d05a9c03d5b846
SSDEEP 98304:8bQUVZFz/Mg7nht3QFL9eKyBi1y8eiUlOX:InFTMyn/3QjWl
TLSH
T16F864B1BF8A614D6C2FEE1708A965222BF7134A5C33137D76F9086951B66FE4B93E300
MD5 SHA1 SHA512 SSDEEP TLSH

linux x64