b5b44dcb467d9a20c0a8f11feb8bf7ae743bce8fa1c4579b249867e6512d6f4c

General

Target
2026-10-02_32168095e9f52bbae400356366cd10f8_glassworm_qnapcrypt
Size 3.9MB
Sample261003-sb2p2a1crd
SHA256 b5b44dcb467d9a20c0a8f11feb8bf7ae743bce8fa1c4579b249867e6512d6f4c
MD5 32168095e9f52bbae400356366cd10f8
SHA1 2fc67ea54d6ecfd447140dfe64e94626685a858e
SHA512 7f9d0d2b8c8e6048385f118b0c9ec399b753613b8c7a64632e4a4d89adcb02a1e31fc516661138f4e7e518a30c13dce11d451a1f4c0eb15b845f8de7572fb5aa
SSDEEP 49152:O2DHxSAaaFnKu1C3FHw92agOl7Zk48dSbqA:OgNOC2arl74dSb1
TLSH
T14216BF4BBDE03954C626523B89EA69C26F7CFE472B3117C73E40736A1A725D618F4328
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-10-02_32168095e9f52bbae400356366cd10f8_glassworm_qnapcrypt
- Size 3.9MB
- SHA256 b5b44dcb467d9a20c0a8f11feb8bf7ae743bce8fa1c4579b249867e6512d6f4c
- MD5 32168095e9f52bbae400356366cd10f8
- SHA1 2fc67ea54d6ecfd447140dfe64e94626685a858e
- SHA512 7f9d0d2b8c8e6048385f118b0c9ec399b753613b8c7a64632e4a4d89adcb02a1e31fc516661138f4e7e518a30c13dce11d451a1f4c0eb15b845f8de7572fb5aa
- SSDEEP 49152:O2DHxSAaaFnKu1C3FHw92agOl7Zk48dSbqA:OgNOC2arl74dSb1
- TLSH
  T14216BF4BBDE03954C626523B89EA69C26F7CFE472B3117C73E40736A1A725D618F4328
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm credential_access defense_evasion discovery execution privilege_escalation
- Creates Raw socket
  Creates a socket that captures raw packets at the device level
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
- Reads AppArmor ptrace settings
  Discovery of allowed ptrace capabilities by AppArmor.
  discovery
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads data from the clipboard
  Attempts to collect data stored in the clipboard using xclip tool.
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
- Reads network interface configuration
  Fetches information about one or more active network interfaces.
  discovery
- Uses Polkit to run commands
  Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.
- Virtualization/Sandbox Evasion: Time Based Evasion
  Adversaries may detect and evade virtualized environments and sandboxes.
  defense_evasion
- Reads process memory
  Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
  credential_access
behavioral1