Overview

overview

8

Static

static

1

2026-06-02...pcrypt

ubuntu-18.04-amd64

8

Resubmissions

10/07/2026, 15:09

260710-sjf4asbx2p10

02/06/2026, 02:44

260602-c8ct6sdv5n8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    02/06/2026, 02:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_86bdfb7772d0148079e57661ddab6fdb_glassworm_poet-rat_qnapcrypt
  • Size 6.4MB
  • Sample260602-c8ct6sdv5n
  • SHA256 d2d05a22cb9ab91fce74e8444600e8717dc837e624bf7eea0a00796d9616b00e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
antivmdefense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Adds new SSH keys 1 TTPs 1 IoCs

    Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

    persistenceprivilege_escalation
  • Contacts a large (645) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Deletes itself 1 IoCs
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Virtualization/Sandbox Evasion: Time Based Evasion 1 TTPs 15 IoCs

    Adversaries may detect and evade virtualized environments and sandboxes.

    defense_evasion
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 30 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/2026-06-02_86bdfb7772d0148079e57661ddab6fdb_glassworm_poet-rat_qnapcrypt
    /tmp/2026-06-02_86bdfb7772d0148079e57661ddab6fdb_glassworm_poet-rat_qnapcrypt
    1⤵
    • Adds new SSH keys
    • Deletes itself
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    PID:1483
    • /bin/uname
      uname -a
      2⤵
        PID:1503
      • /bin/cat
        cat /proc/cpuinfo
        2⤵
        • Checks CPU configuration
        PID:1504
      • /bin/cat
        cat /etc/issue
        2⤵
          PID:1505
        • /usr/bin/free
          free -h
          2⤵
          • Reads CPU attributes
          PID:1506
        • /usr/bin/uptime
          uptime
          2⤵
          • Virtualization/Sandbox Evasion: Time Based Evasion
          • Reads CPU attributes
          • Reads runtime system information
          PID:1507
        • /bin/journalctl
          journalctl -S "@0" -u sshd
          2⤵
          • Reads runtime system information
          PID:1508
        • /bin/cat
          cat "/var/log/auth*"
          2⤵
            PID:1510
          • /bin/zcat
            zcat "/var/log/auth*"
            2⤵
              PID:1511
            • /bin/gzip
              gzip -cd "/var/log/auth*"
              2⤵
              • System Network Configuration Discovery
              PID:1511
            • /usr/bin/free
              free -h
              2⤵
              • Reads CPU attributes
              PID:1512
            • /usr/bin/uptime
              uptime
              2⤵
              • Virtualization/Sandbox Evasion: Time Based Evasion
              • Reads CPU attributes
              PID:1513
            • /usr/bin/free
              free -h
              2⤵
              • Reads CPU attributes
              • Reads runtime system information
              PID:1514
            • /usr/bin/uptime
              uptime
              2⤵
              • Virtualization/Sandbox Evasion: Time Based Evasion
              • Reads CPU attributes
              PID:1515
            • /usr/bin/free
              free -h
              2⤵
              • Reads CPU attributes
              PID:1518
            • /usr/bin/uptime
              uptime
              2⤵
              • Virtualization/Sandbox Evasion: Time Based Evasion
              • Reads CPU attributes
              • Reads runtime system information
              PID:1519
            • /usr/bin/free
              free -h
              2⤵
              • Reads CPU attributes
              PID:1520
            • /usr/bin/uptime
              uptime
              2⤵
              • Virtualization/Sandbox Evasion: Time Based Evasion
              • Reads CPU attributes
              PID:1521
            • /usr/bin/free
              free -h
              2⤵
              • Reads CPU attributes
              • Reads runtime system information
              PID:1522
            • /usr/bin/uptime
              uptime
              2⤵
              • Virtualization/Sandbox Evasion: Time Based Evasion
              • Reads CPU attributes
              PID:1523
            • /usr/bin/free
              free -h
              2⤵
              • Reads CPU attributes
              PID:1524
            • /usr/bin/uptime
              uptime
              2⤵
              • Virtualization/Sandbox Evasion: Time Based Evasion
              • Reads CPU attributes
              • Reads runtime system information
              PID:1525
            • /usr/bin/free
              free -h
              2⤵
              • Reads CPU attributes
              PID:1526
            • /usr/bin/uptime
              uptime
              2⤵
              • Virtualization/Sandbox Evasion: Time Based Evasion
              • Reads CPU attributes
              PID:1527
            • /usr/bin/free
              free -h
              2⤵
              • Reads CPU attributes
              PID:1528
            • /usr/bin/uptime
              uptime
              2⤵
              • Virtualization/Sandbox Evasion: Time Based Evasion
              • Reads CPU attributes
              PID:1529
            • /usr/bin/free
              free -h
              2⤵
              • Reads CPU attributes
              PID:1530
            • /usr/bin/uptime
              uptime
              2⤵
              • Virtualization/Sandbox Evasion: Time Based Evasion
              • Reads CPU attributes
              PID:1531
            • /usr/bin/free
              free -h
              2⤵
              • Reads CPU attributes
              PID:1532
            • /usr/bin/uptime
              uptime
              2⤵
              • Virtualization/Sandbox Evasion: Time Based Evasion
              • Reads CPU attributes
              PID:1533
            • /usr/bin/free
              free -h
              2⤵
              • Reads CPU attributes
              • Reads runtime system information
              PID:1534
            • /usr/bin/uptime
              uptime
              2⤵
              • Virtualization/Sandbox Evasion: Time Based Evasion
              • Reads CPU attributes
              PID:1535
            • /usr/bin/free
              free -h
              2⤵
              • Reads CPU attributes
              PID:1536
            • /usr/bin/uptime
              uptime
              2⤵
              • Virtualization/Sandbox Evasion: Time Based Evasion
              • Reads CPU attributes
              PID:1537
            • /usr/bin/free
              free -h
              2⤵
              • Reads CPU attributes
              PID:1538
            • /usr/bin/uptime
              uptime
              2⤵
              • Virtualization/Sandbox Evasion: Time Based Evasion
              • Reads CPU attributes
              PID:1539
            • /usr/bin/free
              free -h
              2⤵
              • Reads CPU attributes
              PID:1540
            • /usr/bin/uptime
              uptime
              2⤵
              • Virtualization/Sandbox Evasion: Time Based Evasion
              • Reads CPU attributes
              PID:1541

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                authorized_keys
                • Path /root/.ssh/authorized_keys
                • Size 381B
                • SHA256 43062900b2539d8d1f67f30fa7042c56b53541f63875b5f0de5d8fbde0e0a8bf
                • MD5 SHA1 SHA512 TLSH
                Submit Download