Extracted

• • Target
    2026-09-13_ce41a01b741e297090a8a94a62b57749_glassworm_qnapcrypt
  • Size 1.8MB
  • SHA256 4c05ae8258f1e157d62199dc891cb4614208377804a9c49b46cf165897655308
  • MD5 ce41a01b741e297090a8a94a62b57749
  • SHA1 b1800ab3b2cbde92468d9a8f6d80079333e62154
  • SHA512 59ba5a690d55c7be59f3c5bab4aa4c9ef3e1e9c88ad3f96ccd497532791d689e7228159f53128be3de9adfc2c7cff78ce9572e6158eaa958047a0c8662c3ffb6
  • SSDEEP 24576:DIww1az0HpQKMNRjiSZAwyZW82DBNbT5ppkmesFMpladOmszgBYVVWXyWz1v:/1TbVNH4plzmhBGWz1
  • TLSH
    T1B1952841FD8B54F3E9071B3105AFA2AF23319D054F24EBD7EA44BA6AED376D10832219
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionkaijipersistenceprivilege_escalation

  • Family: Kaiji

    Kaiji is a multi-functional malware written Golang.

    botnetkaiji

  • Kaiji

    Kaiji payload

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence

  • Modifies Bash startup script

    persistence
  behavioral1