Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    14/08/2026, 04:11

General

  • Target
    2026-08-14_6d2368b6f194499e0d0b6437c63bbb66_qnapcrypt
  • Size 2.4MB
  • Sample260814-er8lmacm4x
  • SHA256 e3f7d9e027d1777d7aa128e7c6767538d17930c44f014a97dd678c1022a3236d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 51 IoCs
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 51 IoCs

    Malware often drops required files in the /tmp directory.

  • GoLang User-Agent 2 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

Processes

  • /tmp/2026-08-14_6d2368b6f194499e0d0b6437c63bbb66_qnapcrypt
    /tmp/2026-08-14_6d2368b6f194499e0d0b6437c63bbb66_qnapcrypt
    1⤵
    • Executes dropped EXE
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1489
    • /tmp/firefox
      /tmp/firefox
      2⤵
        PID:1493
      • /tmp/polybar
        /tmp/polybar
        2⤵
          PID:1498
        • /tmp/soffice.bin
          /tmp/soffice.bin
          2⤵
            PID:1502
          • /tmp/gdm3
            /tmp/gdm3
            2⤵
              PID:1503
            • /tmp/packagekitd
              /tmp/packagekitd
              2⤵
                PID:1505
              • /tmp/polkitd
                /tmp/polkitd
                2⤵
                  PID:1506
                • /tmp/plasmashell
                  /tmp/plasmashell
                  2⤵
                    PID:1507
                  • /tmp/lightdm
                    /tmp/lightdm
                    2⤵
                      PID:1508
                    • /tmp/dolphin
                      /tmp/dolphin
                      2⤵
                        PID:1509
                      • /tmp/systemd
                        /tmp/systemd
                        2⤵
                          PID:1510
                        • /tmp/conky
                          /tmp/conky
                          2⤵
                            PID:1511
                          • /tmp/migration
                            /tmp/migration
                            2⤵
                              PID:1512
                            • /tmp/networkd
                              /tmp/networkd
                              2⤵
                                PID:1513
                              • /tmp/init
                                /tmp/init
                                2⤵
                                  PID:1514
                                • /tmp/picom
                                  /tmp/picom
                                  2⤵
                                    PID:1515
                                  • /tmp/gnome-keyring-daemon
                                    /tmp/gnome-keyring-daemon
                                    2⤵
                                      PID:1516
                                    • /tmp/upowerd
                                      /tmp/upowerd
                                      2⤵
                                        PID:1517
                                      • /tmp/alsactl
                                        /tmp/alsactl
                                        2⤵
                                          PID:1518
                                        • /tmp/accounts-daemon
                                          /tmp/accounts-daemon
                                          2⤵
                                            PID:1519
                                          • /tmp/sddm
                                            /tmp/sddm
                                            2⤵
                                              PID:1520
                                            • /tmp/resolved
                                              /tmp/resolved
                                              2⤵
                                                PID:1521
                                              • /tmp/Xorg
                                                /tmp/Xorg
                                                2⤵
                                                  PID:1522
                                                • /tmp/journald
                                                  /tmp/journald
                                                  2⤵
                                                    PID:1523
                                                  • /tmp/kwin_x11
                                                    /tmp/kwin_x11
                                                    2⤵
                                                      PID:1524
                                                    • /tmp/colord
                                                      /tmp/colord
                                                      2⤵
                                                        PID:1525
                                                      • /tmp/rcu_sched
                                                        /tmp/rcu_sched
                                                        2⤵
                                                          PID:1526
                                                        • /tmp/dbus-daemon
                                                          /tmp/dbus-daemon
                                                          2⤵
                                                            PID:1527
                                                          • /tmp/rtkit-daemon
                                                            /tmp/rtkit-daemon
                                                            2⤵
                                                              PID:1528
                                                            • /tmp/kworker
                                                              /tmp/kworker
                                                              2⤵
                                                                PID:1529
                                                              • /tmp/logind
                                                                /tmp/logind
                                                                2⤵
                                                                  PID:1530
                                                                • /tmp/gnome-shell
                                                                  /tmp/gnome-shell
                                                                  2⤵
                                                                    PID:1531
                                                                  • /tmp/ksoftirqd
                                                                    /tmp/ksoftirqd
                                                                    2⤵
                                                                      PID:1532
                                                                    • /tmp/udisksd
                                                                      /tmp/udisksd
                                                                      2⤵
                                                                        PID:1533
                                                                      • /tmp/watchdog
                                                                        /tmp/watchdog
                                                                        2⤵
                                                                          PID:1534
                                                                        • /tmp/i3
                                                                          /tmp/i3
                                                                          2⤵
                                                                            PID:1535
                                                                          • /tmp/avahi-daemon
                                                                            /tmp/avahi-daemon
                                                                            2⤵
                                                                              PID:1536
                                                                            • /tmp/pulseaudio
                                                                              /tmp/pulseaudio
                                                                              2⤵
                                                                                PID:1537
                                                                              • /tmp/openbox
                                                                                /tmp/openbox
                                                                                2⤵
                                                                                  PID:1538
                                                                                • /tmp/lxqt-session
                                                                                  /tmp/lxqt-session
                                                                                  2⤵
                                                                                    PID:1539
                                                                                  • /tmp/sshd
                                                                                    /tmp/sshd
                                                                                    2⤵
                                                                                      PID:1540
                                                                                    • /tmp/evince
                                                                                      /tmp/evince
                                                                                      2⤵
                                                                                        PID:1541
                                                                                      • /tmp/chromium
                                                                                        /tmp/chromium
                                                                                        2⤵
                                                                                          PID:1542
                                                                                        • /tmp/nautilus
                                                                                          /tmp/nautilus
                                                                                          2⤵
                                                                                            PID:1543
                                                                                          • /tmp/rsyslogd
                                                                                            /tmp/rsyslogd
                                                                                            2⤵
                                                                                              PID:1544
                                                                                            • /tmp/thunderbird
                                                                                              /tmp/thunderbird
                                                                                              2⤵
                                                                                                PID:1545
                                                                                              • /tmp/chrome
                                                                                                /tmp/chrome
                                                                                                2⤵
                                                                                                  PID:1546
                                                                                                • /tmp/udevd
                                                                                                  /tmp/udevd
                                                                                                  2⤵
                                                                                                    PID:1547
                                                                                                  • /tmp/timesyncd
                                                                                                    /tmp/timesyncd
                                                                                                    2⤵
                                                                                                      PID:1548
                                                                                                    • /tmp/kthreadd
                                                                                                      /tmp/kthreadd
                                                                                                      2⤵
                                                                                                        PID:1549
                                                                                                      • /tmp/cron
                                                                                                        /tmp/cron
                                                                                                        2⤵
                                                                                                          PID:1550
                                                                                                        • /tmp/ssh-agent
                                                                                                          /tmp/ssh-agent
                                                                                                          2⤵
                                                                                                            PID:1551

                                                                                                        Network

                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              Xorg

                                                                                                              • Path /tmp/Xorg
                                                                                                              • Size 12KB
                                                                                                              • SHA256 54a293d0ba4128685a3f84309314182af7303570337ce5969328c38a1b41c701
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              accounts-daemon

                                                                                                              • Path /tmp/accounts-daemon
                                                                                                              • Size 12KB
                                                                                                              • SHA256 bd0afd86a8947b22a013b46f6aa5d5f441fa30c70688e94a63a3845c24eec7c3
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              alsactl

                                                                                                              • Path /tmp/alsactl
                                                                                                              • Size 12KB
                                                                                                              • SHA256 81a014d655e54e95b1eb8d887aeb00cef3af53ed54b70a3c35b2a6d7feda7bfb
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              avahi-daemon

                                                                                                              • Path /tmp/avahi-daemon
                                                                                                              • Size 12KB
                                                                                                              • SHA256 3da1c6d8018b0cf6068a73f850b9cf597739ac21101ce01c9194c11910fec123
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              chrome

                                                                                                              • Path /tmp/chrome
                                                                                                              • Size 12KB
                                                                                                              • SHA256 018d2947f30387bdddce8a6e561d05b795a4d9d1546bf6c83305d65568b4b63f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              chromium

                                                                                                              • Path /tmp/chromium
                                                                                                              • Size 12KB
                                                                                                              • SHA256 31c155aa6fc7f7bdf8837cb2fd7412da9dabaccc2c5f6ca86d529427b2ef8ee6
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              colord

                                                                                                              • Path /tmp/colord
                                                                                                              • Size 12KB
                                                                                                              • SHA256 0a00ce965925dc0e1b01da0f8ada32a774b4c087d6ade65c74b9610f4602c81b
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              conky

                                                                                                              • Path /tmp/conky
                                                                                                              • Size 12KB
                                                                                                              • SHA256 e855f8017a504252201c831c6a6c962fcbabacf6389d64a0de64780393c6cc1b
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              cron

                                                                                                              • Path /tmp/cron
                                                                                                              • Size 12KB
                                                                                                              • SHA256 e5ad833619459c9bf89bc83916f7bc3c144993041554c92242da033a81dab82a
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              dbus-daemon

                                                                                                              • Path /tmp/dbus-daemon
                                                                                                              • Size 12KB
                                                                                                              • SHA256 3df0ac72b0f1b6f4024b132a982372f394a7579471cc9823a5c891ef73214dfd
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              dolphin

                                                                                                              • Path /tmp/dolphin
                                                                                                              • Size 12KB
                                                                                                              • SHA256 f51a5ca2bd8919eca6d7b5c3f526b7af1924fdeab6fbd56bd0cbe171e647a73e
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              evince

                                                                                                              • Path /tmp/evince
                                                                                                              • Size 12KB
                                                                                                              • SHA256 2f5196dc6c081181a2f1a7390e2834b1cef112458872e1ccf0c7abacaecae3e2
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              firefox

                                                                                                              • Path /tmp/firefox
                                                                                                              • Size 12KB
                                                                                                              • SHA256 660e91c7b6c6583a3b6e10dfbce6a5ba7276e31373caea2190e177838a55309a
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              gdm3

                                                                                                              • Path /tmp/gdm3
                                                                                                              • Size 12KB
                                                                                                              • SHA256 16f7018b91eada1bab0c1d66381dcfa0e164288a3150754d876864fb2112d801
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              gnome-keyring-daemon

                                                                                                              • Path /tmp/gnome-keyring-daemon
                                                                                                              • Size 12KB
                                                                                                              • SHA256 76977182bd9ce31223e262edfc30e9bcf45d9a66d0a2aad73de58cee27fb7425
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              gnome-shell

                                                                                                              • Path /tmp/gnome-shell
                                                                                                              • Size 12KB
                                                                                                              • SHA256 46805a75cc8afd6a9c5b7803838e7dba8630f0186c53a7402f4ad58e1dbd2dea
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              i3

                                                                                                              • Path /tmp/i3
                                                                                                              • Size 12KB
                                                                                                              • SHA256 418ac86604955a69073067b4025217ec049dbfcbefbb3e819922d30541613643
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              init

                                                                                                              • Path /tmp/init
                                                                                                              • Size 12KB
                                                                                                              • SHA256 86d7575b14fa953ddc32768807cf0dff97b0714c2c893612da3880877b0eda68
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              journald

                                                                                                              • Path /tmp/journald
                                                                                                              • Size 12KB
                                                                                                              • SHA256 74808c228163372fa14eec2c430d9b8aeb16a94858196ecda639bb0dd2a51b78
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              ksoftirqd

                                                                                                              • Path /tmp/ksoftirqd
                                                                                                              • Size 12KB
                                                                                                              • SHA256 c06ad1fd20938388c05d3f4680c53d0f7144544626101cea84840e57dc200446
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              kthreadd

                                                                                                              • Path /tmp/kthreadd
                                                                                                              • Size 12KB
                                                                                                              • SHA256 73b88a2945bb337dd5e7a404e66916fc0d71c01b33d01a1e3eeb70dd3333e70b
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              kwin_x11

                                                                                                              • Path /tmp/kwin_x11
                                                                                                              • Size 12KB
                                                                                                              • SHA256 cdc01a7814d0c4887e79010f83591fb10be5a182f25db7748d3625b929868b1e
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              kworker

                                                                                                              • Path /tmp/kworker
                                                                                                              • Size 12KB
                                                                                                              • SHA256 3f3b68a94f1e7a03f01fea6ac51dca92afede55cce68528926be8aca28c9b099
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              lightdm

                                                                                                              • Path /tmp/lightdm
                                                                                                              • Size 12KB
                                                                                                              • SHA256 4be5112a4ab52dc7814dd534b0c9d6dc2b6d5e72029524e97af53287cda95eb5
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              logind

                                                                                                              • Path /tmp/logind
                                                                                                              • Size 12KB
                                                                                                              • SHA256 6b9fe163f50ea4afc4d9063360ddc021bdb4b52bdf1f902a615e0e37f4917ed7
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              lxqt-session

                                                                                                              • Path /tmp/lxqt-session
                                                                                                              • Size 12KB
                                                                                                              • SHA256 edcce815188fe1b94b094d0bfa178c341777cb87c8fd930f0d5748a4bf227ff6
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              migration

                                                                                                              • Path /tmp/migration
                                                                                                              • Size 12KB
                                                                                                              • SHA256 8448872ba4794aad7bf8af0841e26b6e00905394b361b2153a5e06e171225e75
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              nautilus

                                                                                                              • Path /tmp/nautilus
                                                                                                              • Size 12KB
                                                                                                              • SHA256 5728ed92cf728b4dc1d3be3d9fd448ddd0bee58158f08be791197ec185742548
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              networkd

                                                                                                              • Path /tmp/networkd
                                                                                                              • Size 12KB
                                                                                                              • SHA256 91429723bced7099b5fb8460c442ea2a1eb23dfab700571a158d2749b6ab15c7
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              openbox

                                                                                                              • Path /tmp/openbox
                                                                                                              • Size 12KB
                                                                                                              • SHA256 200140de2d2d22c6b530a2abca9d67e08822fe66ac43099976733843714baedf
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              packagekitd

                                                                                                              • Path /tmp/packagekitd
                                                                                                              • Size 12KB
                                                                                                              • SHA256 1792f335d563bb500173724596eb41e49cbabfa42dd4c834b99353ba3fd055af
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              picom

                                                                                                              • Path /tmp/picom
                                                                                                              • Size 12KB
                                                                                                              • SHA256 3a952cf98256bd58b9f39b88e71b853a6e97c9384237569428e50dfb75bf5500
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              plasmashell

                                                                                                              • Path /tmp/plasmashell
                                                                                                              • Size 12KB
                                                                                                              • SHA256 4d82e8b32e6b8885c8c75ac54c409679775322e5ec1aa9c155239027722cbc80
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              polkitd

                                                                                                              • Path /tmp/polkitd
                                                                                                              • Size 12KB
                                                                                                              • SHA256 f9016b59aca19a1c32ffec9f88e1059757adbe39d0699824cf1cea00bac45bb8
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              polybar

                                                                                                              • Path /tmp/polybar
                                                                                                              • Size 12KB
                                                                                                              • SHA256 8cf56b51598b46f8d09eba5b38c88035da473a735938987477bb5f210dfe2663
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              pulseaudio

                                                                                                              • Path /tmp/pulseaudio
                                                                                                              • Size 12KB
                                                                                                              • SHA256 2ee68b2db28cf14bf2e5c15189e32a6e5c0a193b5f709b48e93945365c7a81f4
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              rcu_sched

                                                                                                              • Path /tmp/rcu_sched
                                                                                                              • Size 12KB
                                                                                                              • SHA256 2fef01251294b27986e8ecdcfe882f21618921c0880ccab4fd20566a3451746c
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              resolved

                                                                                                              • Path /tmp/resolved
                                                                                                              • Size 12KB
                                                                                                              • SHA256 a05d1f1108c96485aca9553dfe4c11f39560ba398ba5268ffb3f9c4f890f4ca9
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              rsyslogd

                                                                                                              • Path /tmp/rsyslogd
                                                                                                              • Size 12KB
                                                                                                              • SHA256 c545d2d2e14222f1a3a93333f90d3095f0822507bab1b9227b456f5e8a677f93
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              rtkit-daemon

                                                                                                              • Path /tmp/rtkit-daemon
                                                                                                              • Size 12KB
                                                                                                              • SHA256 3ab0f61d0e12b92c4833ce7a78a225b4394bf57e9046fe740692331a6472b13e
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              sddm

                                                                                                              • Path /tmp/sddm
                                                                                                              • Size 12KB
                                                                                                              • SHA256 673454a1a19a11204e9161bdef7f14462c7ad09e35fe860418a2225ff359c1e8
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              soffice.bin

                                                                                                              • Path /tmp/soffice.bin
                                                                                                              • Size 12KB
                                                                                                              • SHA256 d1d0aa3da6106b6049cacafba8095d85729247a9511add115e10222a8ef35484
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              ssh-agent

                                                                                                              • Path /tmp/ssh-agent
                                                                                                              • Size 12KB
                                                                                                              • SHA256 53c3617f43253120c1a6a2db293333a1f130f4f03e4eae02093091057f6f9b7d
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              sshd

                                                                                                              • Path /tmp/sshd
                                                                                                              • Size 12KB
                                                                                                              • SHA256 2d30a15d179b427eaa073fe2df4b049ab1332434674bea524b1baef8bece8d73
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              systemd

                                                                                                              • Path /tmp/systemd
                                                                                                              • Size 12KB
                                                                                                              • SHA256 ee6e163ea20e5fad7acff35506a9960e7059e50c1b429557bf68311e730d2566
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              thunderbird

                                                                                                              • Path /tmp/thunderbird
                                                                                                              • Size 12KB
                                                                                                              • SHA256 a6eba22058323da8a645a839bf8f9d9e8ad07844fd1f33c0eaeea31cbf555f88
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              timesyncd

                                                                                                              • Path /tmp/timesyncd
                                                                                                              • Size 12KB
                                                                                                              • SHA256 bbfbb5a8b7f62d54ef15fd120462a649d819fc512057307e7df73fbf0198e7f2
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              udevd

                                                                                                              • Path /tmp/udevd
                                                                                                              • Size 12KB
                                                                                                              • SHA256 6ff238449d31f9dd21e61c5d27be4a0c4c9d051fbd3b360f0fc8fe12c4dc9b0c
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              udisksd

                                                                                                              • Path /tmp/udisksd
                                                                                                              • Size 12KB
                                                                                                              • SHA256 2bd4b075fd492142d0ac276e4dc5d117d2f96ee10ece24967d037dcede09e38a
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              upowerd

                                                                                                              • Path /tmp/upowerd
                                                                                                              • Size 12KB
                                                                                                              • SHA256 89e5bf2f23a417efa9a38a56ec613b69ebad8aabcc988c4c560807ed8747dd79
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                              watchdog

                                                                                                              • Path /tmp/watchdog
                                                                                                              • Size 12KB
                                                                                                              • SHA256 cef301ccac4edc1f3eb689a938396d2fe6664ce29902f985f0ad4722275642f3
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH