426a2e0e9cd1dca0b2852cbc5d4a82d41ac0f9dbc2d285cf49d626b40ccec30a

Analysis

max time kernel
0s
max time network
131s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
02/10/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_bb508029d7804c8d58c566d2d2087984_glassworm_qnapcrypt
Size 23.0MB
Sample261002-e32mfsvv3q
SHA256 426a2e0e9cd1dca0b2852cbc5d4a82d41ac0f9dbc2d285cf49d626b40ccec30a
MD5 bb508029d7804c8d58c566d2d2087984
SHA1 7953ac84fa9a656773e629b92b0c3115f6fbfc9d
SHA512 6701ab3b085417fd278dea908da31cecaa1114f14ce5e543853191b690278e722d227531c8d97ded252ca1795c6e0c5ee48885eb51377ae6e11234f5c001ecc7
SSDEEP 98304:h39b8StQJ45qlpflFBsFWguKrJp69FfNxzECQi0RMfzWC9cl+qtToGMrKViye:h53rqlFiTCQi0RMfKC92rt2rKK
TLSH
T185374A13FC5604D2C598A230CA6996923BB03D464F34DBD727A4FA382FB77D49A7A314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-10-01_bb508029d7804c8d58c566d2d2087984_glassworm_qnapcrypt
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	2026-10-01_bb508029d7804c8d58c566d2d2087984_glassworm_qnapcrypt
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us	2026-10-01_bb508029d7804c8d58c566d2d2087984_glassworm_qnapcrypt

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/cgroup	2026-10-01_bb508029d7804c8d58c566d2d2087984_glassworm_qnapcrypt
File opened for reading	/proc/self/mountinfo	2026-10-01_bb508029d7804c8d58c566d2d2087984_glassworm_qnapcrypt

/tmp/2026-10-01_bb508029d7804c8d58c566d2d2087984_glassworm_qnapcrypt
/tmp/2026-10-01_bb508029d7804c8d58c566d2d2087984_glassworm_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1487

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads