General
- Target 2026-08-20_90d5ce89cf8ec7f180165377696800ac_ddos-tf_glassworm_poet-rat_qnapcrypt
- Size 19.0MB
- Sample260820-v3lt1ascke
- SHA256 3ef85e0f46aa371533521fe026bae2e0829677f6c067bd1a29d553a102a2455a
- MD5 90d5ce89cf8ec7f180165377696800ac
- SHA1 11c86d260138f911e9a10c0441f17a9050f178a2
- SHA512 8820d635c1da9876283014d332329839fc40c9e254a20342a61ce3f32ff16eeff551545c8397ab3c641691e4d5a4954495cc93a2faa433c2358336a959eaf80f
- SSDEEP 196608:EFcok0oGdS2M8aGLghiIwdIlzNf/6iR7wz3MWgrITE1cgt1aBakUEAa:E4a42nQhHwdo3Jpo2ZcGg0x
- TLSH T1BB173A46F89254F5C1FEE03086466762BB71386643303BE75E90AB751E3AFE46A3D702
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-20_90d5ce89cf8ec7f180165377696800ac_ddos-tf_glassworm_poet-rat_qnapcrypt
Resource
ubuntu1804-amd64-20260513-en
Malware Config
Targets
-
- Target 2026-08-20_90d5ce89cf8ec7f180165377696800ac_ddos-tf_glassworm_poet-rat_qnapcrypt
- Size 19.0MB
- SHA256 3ef85e0f46aa371533521fe026bae2e0829677f6c067bd1a29d553a102a2455a
- MD5 90d5ce89cf8ec7f180165377696800ac
- SHA1 11c86d260138f911e9a10c0441f17a9050f178a2
- SHA512 8820d635c1da9876283014d332329839fc40c9e254a20342a61ce3f32ff16eeff551545c8397ab3c641691e4d5a4954495cc93a2faa433c2358336a959eaf80f
- SSDEEP 196608:EFcok0oGdS2M8aGLghiIwdIlzNf/6iR7wz3MWgrITE1cgt1aBakUEAa:E4a42nQhHwdo3Jpo2ZcGg0x
- TLSH T1BB173A46F89254F5C1FEE03086466762BB71386643303BE75E90AB751E3AFE46A3D702
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
Network activity triggered a Suricata alert
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
-
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Unix Shell
1Scheduled Task/Job
1Cron
1User Execution
2Malicious File
1Persistence
Boot or Logon Autostart Execution
3XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
3XDG Autostart Entries
1Boot or Logon Initialization Scripts
1RC Scripts
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1