9bee016115d1efc6707389331a4a9812b5b62905f6855df9868bea086303c542

Analysis

max time kernel
148s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22/05/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_c57a8bd8eb16be1c844421f18acf541c_dosia_poet-rat_qnapcrypt_sliver
Size 31.2MB
Sample260522-calpese141
SHA256 9bee016115d1efc6707389331a4a9812b5b62905f6855df9868bea086303c542
MD5 c57a8bd8eb16be1c844421f18acf541c
SHA1 d9ef6f53d19afa68ab4f179131fa665b885d52c8
SHA512 fca989f2dde456e0f96bd5561a4ba1a6b28a31fc6907179a1fea4d8a45deb22cc6ec29dfd122ded3a8ce48db17d6f56708463b412768c37d8bda52d080c81c5b
SSDEEP 196608:cZGA1wVYrcPIH5ojpvg/WJefC9ozeMvYHJ00HYbRMCONWHmw3B4gQ:cE3PIH5ojpv0QwC5HJNH8RIN5gQ
TLSH
T1EB672967E8A21594C4EEC274D673817BBB623C4D5B7823E70690F3241F32BE096B6752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us	2026-05-22_c57a8bd8eb16be1c844421f18acf541c_dosia_poet-rat_qnapcrypt_sliver
File opened for reading	/sys/kernel/mm/hugepages	2026-05-22_c57a8bd8eb16be1c844421f18acf541c_dosia_poet-rat_qnapcrypt_sliver
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-05-22_c57a8bd8eb16be1c844421f18acf541c_dosia_poet-rat_qnapcrypt_sliver
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	2026-05-22_c57a8bd8eb16be1c844421f18acf541c_dosia_poet-rat_qnapcrypt_sliver

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/cgroup	2026-05-22_c57a8bd8eb16be1c844421f18acf541c_dosia_poet-rat_qnapcrypt_sliver
File opened for reading	/proc/self/mountinfo	2026-05-22_c57a8bd8eb16be1c844421f18acf541c_dosia_poet-rat_qnapcrypt_sliver

/tmp/2026-05-22_c57a8bd8eb16be1c844421f18acf541c_dosia_poet-rat_qnapcrypt_sliver
/tmp/2026-05-22_c57a8bd8eb16be1c844421f18acf541c_dosia_poet-rat_qnapcrypt_sliver
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1470

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads