602f6821df5aff54410bb81caadc8e0fc0f12c583b57fd8738ce896326c04bff

General

Target
2026-10-02_17f84e657b8ee6fc507453934a026932_glassworm_qnapcrypt
Size 3.9MB
Sample261003-t8b2basfpe
SHA256 602f6821df5aff54410bb81caadc8e0fc0f12c583b57fd8738ce896326c04bff
MD5 17f84e657b8ee6fc507453934a026932
SHA1 36e9704def8c781d149bed429bacb0e2334d8b5e
SHA512 f7e74c857c575db864fd1dd804c1a6259ff807cc3b42475f0f4d5df776131d3497898e84850a464bc2e931909b40d06210e87023f8b1259b141e41a642cab4c9
SSDEEP 24576:cWo6h2UBLC6CPg2g+rR0o/tdGGoCSH3PdJwuZyWVn1WvIYBSFA1aY4MwFsAvLYrM:cMLi60BxiA1azsAvUCmo7l1cprME6Pv
TLSH
T13B16BF45ED8725B5D7021A3648EF56DB0B2CBF072F319B87B9447BAA613709B14F222C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-10-02_17f84e657b8ee6fc507453934a026932_glassworm_qnapcrypt
- Size 3.9MB
- SHA256 602f6821df5aff54410bb81caadc8e0fc0f12c583b57fd8738ce896326c04bff
- MD5 17f84e657b8ee6fc507453934a026932
- SHA1 36e9704def8c781d149bed429bacb0e2334d8b5e
- SHA512 f7e74c857c575db864fd1dd804c1a6259ff807cc3b42475f0f4d5df776131d3497898e84850a464bc2e931909b40d06210e87023f8b1259b141e41a642cab4c9
- SSDEEP 24576:cWo6h2UBLC6CPg2g+rR0o/tdGGoCSH3PdJwuZyWVn1WvIYBSFA1aY4MwFsAvLYrM:cMLi60BxiA1azsAvUCmo7l1cprME6Pv
- TLSH
  T13B16BF45ED8725B5D7021A3648EF56DB0B2CBF072F319B87B9447BAA613709B14F222C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm credential_access defense_evasion discovery execution privilege_escalation
- Creates Raw socket
  Creates a socket that captures raw packets at the device level
- OS Credential Dumping
  Adversaries may attempt to dump credentials to use it in password cracking.
  credential_access
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
- Reads AppArmor ptrace settings
  Discovery of allowed ptrace capabilities by AppArmor.
  discovery
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates active TCP sockets
  Gets active TCP sockets from /proc virtual filesystem.
  discovery
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads data from the clipboard
  Attempts to collect data stored in the clipboard using xclip tool.
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
- Reads network interface configuration
  Fetches information about one or more active network interfaces.
  discovery
- Uses Polkit to run commands
  Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.
- Virtualization/Sandbox Evasion: Time Based Evasion
  Adversaries may detect and evade virtualized environments and sandboxes.
  defense_evasion
- Reads process memory
  Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
  credential_access
behavioral1