Analysis
- max time kernel
148s - max time network
143s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
18/05/2026, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
150 seconds
General
- Target 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt
- Size 6.9MB
- Sample260518-ca9fgsa16j
- SHA256 bdb56d71cbb1a7ddc487b97dd589ec48757f39e5659281c89971ae964169a1a8
- MD5 e4ff58a1b6792e2d02cb4f5663c9a0fa
- SHA1 33468c1c6dd85619ccad606093df1591a84ff560
- SHA512 557a35f00040fa26095f652600009e1303a222ddb88b539299c261d44237f26d7a82de39fde3a7ca1541a46de709bdfd4cf8147a7c751f1543b4d12a279ef8f7
- SSDEEP 49152:4Q3TcXmOI4t6Y/1u6SDfyfp34uOL72rMaTSzPEWkfk7IgRYyUsdE6mCLpe5EA:TIXYBY9u6S2vO3Mb2PE36TgHEA
- TLSH T139762711FE8B50F2E9031D3105ABB22F67325D054F25EBE3EA407F29F97B691193A249
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/lib/upower/upowerd 1497 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt - Enumerates kernel/hardware configuration 1 TTPs 6 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt -
description ioc Process File opened for reading /proc/10/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/27/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/1476/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/1485/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/162/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/79/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/89/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/12/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/164/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/173/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/20/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/22/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/1486/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/174/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/19/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/3/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/82/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/84/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/159/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/160/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/24/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/6/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/83/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/163/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/166/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/203/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/31/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/4/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/83/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/35/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/36/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/6/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/80/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/137/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/161/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/164/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/28/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/1488/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/13/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/1485/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/169/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/175/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/81/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/26/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/32/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/172/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/178/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/20/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/86/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/self/mountinfo 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/29/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/86/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/165/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/17/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/19/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/204/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/21/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/24/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/34/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/4/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/115/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/15/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/16/environ 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/169/stat 2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt
Processes
-
/tmp/2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt/tmp/2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt1⤵
- Enumerates kernel/hardware configuration
PID:1488 -
/tmp/2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt/tmp/2026-05-18_e4ff58a1b6792e2d02cb4f5663c9a0fa_dosia_glassworm_poet-rat_qnapcrypt2⤵
- Changes its process name
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1492
-