Extracted

• • Target
    2026-09-16_2b047106dd852f60e2a61a44aec04835_glassworm_qnapcrypt
  • Size 1.9MB
  • SHA256 126bdd9d4a11e0c63be87928fd62bef6fac0bcc47d731a143e1e7ddbe05df4f7
  • MD5 2b047106dd852f60e2a61a44aec04835
  • SHA1 72afde419c42903a758fb007de31f3de3651ef56
  • SHA512 fe21c6026d529724cc7e69f4f4a3a666e2bf45da736a6af4e4779479075754c74cfeaa2da0df1506f175d8f9cfd4798ef66e5a1a0d4fccd7937458d15cb243b3
  • SSDEEP 49152:XXPVKrbvGOQLeS7rb/TCvO90d7HjmAFd4A64nsfJrkaani38y4B+g2vUqHOErz1J:tPXZzp
  • TLSH
    T1D5952847B89156A9C0AAE234CA664252B761BC991F3163D73F10B3F82F33BD45E39358
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionkaijipersistenceprivilege_escalation

  • Family: Kaiji

    Kaiji is a multi-functional malware written Golang.

    botnetkaiji

  • Kaiji

    Kaiji payload

  • Executes dropped EXE

  • Modifies Watchdog functionality

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion

  • Creates/modifies Cron job

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation

  • Creates/modifies environment variables

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d

    Adds/modifies system service, likely for persistence.

    persistence

  • Write file to user bin folder

    persistence

  • Modifies Bash startup script

    persistence
  behavioral1