09fa0228849cb7a21d69450387798e4b2a706c5c13235f85ab5b580ef811f246

Analysis

max time kernel
148s
max time network
149s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260127-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260127-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
06/05/2026, 21:32

Target
2026-05-06_87b999bb80e60d1c31b2224ce1c216d1_dosia_glassworm_poet-rat_qnapcrypt
Size 9.8MB
Sample260506-1dpggsa151
SHA256 09fa0228849cb7a21d69450387798e4b2a706c5c13235f85ab5b580ef811f246
MD5 87b999bb80e60d1c31b2224ce1c216d1
SHA1 d7c479e0c8e6fdbfaa108d07d999a909c082fe94
SHA512 a879c281130756f527cda8818fa5f02eea0370704794c4660d90214c2331546f7dfb20848de689da72678c99f598bc53fbe7e9d32c25f88c1c4c2d751aad62d0
SSDEEP 98304:b9UoCPf1JAPEkuM+Rrt14Wt3Mkz1BEyukPGIEfd0BzF+eFdv+HunywM1QQ+:PG1I0M+Rrt3tr1Cys1qD+eFF+H+ywS+
TLSH
T116A68C02FDCB50FAEA031A3005ABA27F23315C064F65EBD7EB407B29F9BB5951936149
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-05-06_87b999bb80e60d1c31b2224ce1c216d1_dosia_glassworm_poet-rat_qnapcrypt

/tmp/2026-05-06_87b999bb80e60d1c31b2224ce1c216d1_dosia_glassworm_poet-rat_qnapcrypt
/tmp/2026-05-06_87b999bb80e60d1c31b2224ce1c216d1_dosia_glassworm_poet-rat_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
PID:1571

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact