14e8cf9a026d9bdcd5dae52442b9883dad551083412bed36afc003995ae5156f

Analysis

max time kernel
2s
max time network
145s
platform
debian-12_armhf
resource
debian12-armhf-20260127-en
resource tags

arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
02/10/2026, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_ada2656eb1ca842efbf90ceb77f8f37a_glassworm
Size 9.3MB
Sample261002-gp93sas1ev
SHA256 14e8cf9a026d9bdcd5dae52442b9883dad551083412bed36afc003995ae5156f
MD5 ada2656eb1ca842efbf90ceb77f8f37a
SHA1 7a321560b0ad6b977c9958d00effb430cad3c5a4
SHA512 ce6eb6c573a397bb7d8eab3b0d2defe7376b839548f4df4a9bb259f2aee8c0a09c84cb0dd4e092cdfa3db0d82b0b3f7a427a556df90be9419f884594508d5f24
SSDEEP 98304:LBq3YR1bKOPXolasgyfibXLVFlGyaHI1topx+hg/Ol:vbZPXhsTfKaob8chg/A
TLSH
T11BA6BF10A1C42C94C9DB31B731C646C865249CD136E589B0694EC8792BFB72FB2FBD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Changes its process name 8 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	veil-scheduler	803	2026-10-01_ada2656eb1ca842efbf90ceb77f8f37a_glassworm
Changes the process name, possibly in an attempt to hide itself	veil-http	804	2026-10-01_ada2656eb1ca842efbf90ceb77f8f37a_glassworm
Changes the process name, possibly in an attempt to hide itself	veil-httpworker	805	2026-10-01_ada2656eb1ca842efbf90ceb77f8f37a_glassworm
Changes the process name, possibly in an attempt to hide itself	veil-httpworker	806	2026-10-01_ada2656eb1ca842efbf90ceb77f8f37a_glassworm
Changes the process name, possibly in an attempt to hide itself	veil-httpworker	807	2026-10-01_ada2656eb1ca842efbf90ceb77f8f37a_glassworm
Changes the process name, possibly in an attempt to hide itself	veil-httpworker	808	2026-10-01_ada2656eb1ca842efbf90ceb77f8f37a_glassworm
Changes the process name, possibly in an attempt to hide itself	veil-txindex	809	2026-10-01_ada2656eb1ca842efbf90ceb77f8f37a_glassworm
Changes the process name, possibly in an attempt to hide itself	veil-shutoff	781	2026-10-01_ada2656eb1ca842efbf90ceb77f8f37a_glassworm

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	2026-10-01_ada2656eb1ca842efbf90ceb77f8f37a_glassworm

/tmp/2026-10-01_ada2656eb1ca842efbf90ceb77f8f37a_glassworm
/tmp/2026-10-01_ada2656eb1ca842efbf90ceb77f8f37a_glassworm
1⤵
- Changes its process name
- Reads CPU attributes
PID:781

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.cookie.tmp

Path /.veil/.cookie.tmp
Size 75B
SHA256 4c45b3547aaa3743691a93cb357bf5f4db38adb938e83de37d5abf8d06a3b7b4
MD5 9ee0f1bffaee935ec6132b65c3cce3dc
SHA1 a59823b533f6a98782171a68fb92cb306a4f5cf1
SHA512 5f35897e229641b79ec9f6eafe29528f52a5e8de4dd416dbbb7c5e7aedde3226fe6a67d62476fedf1c3ae1857687295eacf0670380be615d66a9f1432beb601c
TLSH
T1A2A012532404A2012F8E464CC6903080914A5181009110045624286294004000E82C44
MD5 SHA1 SHA512 TLSH

Submit Download

blk00000.dat

Path /.veil/blocks/blk00000.dat
Size 535B
SHA256 b97cbb422f38ff19210d7fb5a906cc5c282b8c310f09e9ab569c34c3a667dbed
MD5 689dd194b8a4b366bcd0eb8da5254457
SHA1 c0e83d54a7e217522e1ed8680940d0634595ca99
SHA512 440eb5bf2ecad44fd01a0d81dcbc16d59d2a2a4e880952201ff7011f06d990ccbe897838eec196d6a06edd202a48d7dad1929d3ce34901774b5199c9794ebcdf
TLSH
T196F0C03D3392AAD1D73494B74B4C1870D130E9809F71433F4CD4D4A91C2450DA3AC841
MD5 SHA1 SHA512 TLSH

Submit Download

000001.dbtmp

Path /.veil/blocks/index/000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000002.dbtmp

Path /.veil/blocks/index/000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

000003.log

Path /.veil/blocks/index/000003.log
Size 553B
SHA256 f0d2bb7cc6722707db449f21c2b5568aac5360710bf31356f0c3f996f2ff4f37
MD5 4bb03b6879b18b0e37f111819370ffe8
SHA1 f66dcb95431c762bfc0f0254c44d7c304464ba69
SHA512 df4721df578cdc2982e4169799b7048a9df702114d4bb7f9855ade039d4e10269c894ea913b620ea4741454209abaca31a03c3e038b54cd72b89033b4dade7a4
TLSH
T199F0A710DFB1AA01C845053595088608A3B0519828B1524B417C94D11D0A1952EB9D6C
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path /.veil/blocks/index/MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000002

Path /.veil/blocks/index/MANIFEST-000002
Size 50B
SHA256 e292f241daafc3df90f3e2d339c61c6e2787a0d0739aac764e1ea9bb8544ee97
MD5 22bf0e81636b1b45051b138f48b3d148
SHA1 56755d203579ab356e5620ce7e85519ad69d614a
SHA512 a4cf1f5c74e0df85dda8750be9070e24e19b8be15c6f22f0c234ef8423ef9ca3db22ba9ef777d64c33e8fd49fada6fcca26c1a14ba18e8472370533a1c65d8d0
TLSH
T17490021C99D4C448561D58E956163061115052458113DAE029445D5834948710525164
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path /.veil/chainstate/000003.log
Size 46B
SHA256 dd934be6e53556db68098e3a5a511a9ac04f3549c549df31643c7448ec80bde2
MD5 4b93f04e845fd3cfe0c76247531ea70d
SHA1 afa99d7ff524fe0cd1bd59612a24b8931a48da3f
SHA512 ee7f33f7687823dfdb354ae7f3d3abe457d94169e6bc1c8808d9afa660208a00147173d4e25ee812adb8cb1e11a5b674ec3f6f6b570e817d4f3df540d2b539ba
MD5 SHA1 SHA512

Submit Download

debug.log

Path /.veil/debug.log
Size 3KB
SHA256 81a452907deed955fe41a7394874bc28027e8745ec0a146a413236f8ea73f9c2
MD5 9d729ae3691e2309592684470df64950
SHA1 978eac73111b1e1a9063e0be045452ebe7d4e086
SHA512 bb9f68f95a017514bebff15a050404f3c278d77b04704eeaf4feceda316b61f6adf939853e9667f6270d058e8126bf817713f03c0fd58fbed2d049f2de237b79
TLSH
T1397131396AE39160F30A220080CD3BFB1AB2B1B536CA50FCF649C214CDCD856BB69543
MD5 SHA1 SHA512 TLSH

Submit Download

fee_estimates.dat

Path /.veil/fee_estimates.dat
Size 242KB
SHA256 4ad832499af3ecbcb85a5766134dffa0310810fd2217a40d2ba7e1991250b05a
MD5 a756c1bfc09a3336d7a4d84075c58810
SHA1 baf49bf6937c93a1ef64166da739b34e284b735e
SHA512 bd481bf790c1050b1e06f6f4bc6a42f95113102abf2afa2dab580aa5cafba2ced492392bf4bdb7ffbe6a1631490f55144c9e38a029df686458a99b93a4366c95
SSDEEP 24:O1NaHmIYM7ll+rc+h2pS9U/J43gaEF6Nt6yidX+okQ0MKJ1A3oEXsT:OPaGILKhBC4mYNIyWbkQ1KJG3o
TLSH
T18E34C80BCD011A62EA200537906C90CCFC6DA96F576CB46D2B967228FA4DD7A6F5580B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

veild.pid

Path /.veil/veild.pid
Size 4B
SHA256 04e0e75067e564d696d0d38be18b52aca9e015c750ce94153f0f97edac76bcc9
MD5 80b4b5e1f812f12e736c1d2876933f1c
SHA1 230af4b833a1b99c3836d30257300d776f62e0d4
SHA512 41cee538cea1f54a94ad52e2bf7672364b285c75f88656f05ca8215cad3c342d3f9b0899487549e8955d51370b0d6bc0eff3dd9ee7cccc8f683c68cc7e898c39
MD5 SHA1 SHA512

Submit Download

log.0000000001

Path /.veil/wallets/database/log.0000000001
Size 1024KB
SHA256 dfd63894642f652239c41274edde3504fff8191c38613a3d961ef11f84d8eb6c
MD5 4992c81a89dd8575e5abb52311e6d845
SHA1 4394f75fad13b303e0ba09fd4776b732277ffbf1
SHA512 99bbc93f1e2e80d48bae26eea8169fef2e6b1e4459bf2b8ed11c6c42c37a8d73a96cf32c6bcf889409701d44efb532f361abe349891be582fa1dbcd3ec283db0
SSDEEP 3:QkNhl1/t1Xll:QuH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads