58f0583beeca52473ef095bbbeadf66bc3d698544b457c80b3f39be6538716e8

Analysis

max time kernel
138s
max time network
146s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20251231-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20251231-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
04/01/2026, 03:58

Target
2026-01-04_811d899c48ea90f5d032898c9d265cd7_dosia_glassworm_poet-rat_qnapcrypt
Size 7.1MB
Sample260104-ejvd2ayqfz
SHA256 58f0583beeca52473ef095bbbeadf66bc3d698544b457c80b3f39be6538716e8
MD5 811d899c48ea90f5d032898c9d265cd7
SHA1 748b3c4bcbcc732a94b8bf7458b602e4812aae71
SHA512 4f89d8dd567b08287486f0ed2d4d1aa12cf182d09676ed021bc3a1a32c64a869ccc9738b0b3ecdcfc225b53903d57608a412935f62532f8c8ee15f9ab6aefe2b
SSDEEP 49152:2B73zKuG/iQ6rb/TQvO90d7HjmAFd4A64nsfJrtPoAMNHDBXuv6HG/oPLGc0iff0:7fHDhRuxi1EySimp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-01-04_811d899c48ea90f5d032898c9d265cd7_dosia_glassworm_poet-rat_qnapcrypt

/tmp/2026-01-04_811d899c48ea90f5d032898c9d265cd7_dosia_glassworm_poet-rat_qnapcrypt
/tmp/2026-01-04_811d899c48ea90f5d032898c9d265cd7_dosia_glassworm_poet-rat_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
PID:1523

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact