Overview

overview

7

Static

static

1

2026-07-30...pcrypt

ubuntu-18.04-amd64

7

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    30/07/2026, 22:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_6d8b761a720ade7aefd7ec59e964d1b4_dosia_glassworm_poet-rat_qnapcrypt
  • Size 5.4MB
  • Sample260730-2dbq3age97
  • SHA256 6d2c2d34c68011d26eb57a76a52c5a5772add0fb6949688deb561776614c2809
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
antivmdefense_evasiondiscoverystealer

Malware Config

Signatures

  • Reads EFI boot settings 1 TTPs 1 IoCs

    Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

    stealer
  • Checks SCSI settings 1 TTPs 1 IoCs

    Checks list of SCSI devices which may be used to detect VMware or VirtualBox.

    antivm
  • Checks hardware identifiers (DMI) 1 TTPs 12 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Checks mountinfo of local process 1 TTPs 1 IoCs

    Checks mountinfo of running processes which indicate if it is running in chroot jail.

    antivm
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads hardware information 1 TTPs 15 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Reads list of loaded kernel modules 1 TTPs 2 IoCs

    Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

    defense_evasion
  • Checks CPU configuration 1 TTPs 3 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Peripheral Device Discovery 1 TTPs 1 IoCs

    Adversaries may attempt to discover attached peripheral devices.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 6 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/2026-07-30_6d8b761a720ade7aefd7ec59e964d1b4_dosia_glassworm_poet-rat_qnapcrypt
    /tmp/2026-07-30_6d8b761a720ade7aefd7ec59e964d1b4_dosia_glassworm_poet-rat_qnapcrypt
    1⤵
    • Reads EFI boot settings
    • Checks SCSI settings
    • Checks hardware identifiers (DMI)
    • Checks mountinfo of local process
    • Reads hardware information
    • Reads list of loaded kernel modules
    • Checks CPU configuration
    • Reads system network configuration
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    PID:1492
    • /sbin/ip
      ip route
      2⤵
      • System Network Configuration Discovery
      PID:1496
    • /usr/bin/xdpyinfo
      xdpyinfo
      2⤵
        PID:1499
      • /bin/uname
        uname -a
        2⤵
          PID:1500
        • /sbin/ip
          ip -brief addr
          2⤵
          • System Network Configuration Discovery
          PID:1502
        • /sbin/ip
          ip -brief route
          2⤵
          • System Network Configuration Discovery
          PID:1503
        • /usr/bin/lsb_release
          lsb_release -a
          2⤵
            PID:1504
            • /usr/local/sbin/dpkg-query
              dpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security
              3⤵
                PID:1506
              • /usr/local/bin/dpkg-query
                dpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security
                3⤵
                  PID:1506
                • /usr/sbin/dpkg-query
                  dpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security
                  3⤵
                    PID:1506
                  • /usr/bin/dpkg-query
                    dpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security
                    3⤵
                      PID:1506
                  • /usr/bin/who
                    who
                    2⤵
                      PID:1507
                    • /usr/bin/systemd-detect-virt
                      systemd-detect-virt
                      2⤵
                      • Checks hardware identifiers (DMI)
                      • Reads hardware information
                      • Checks CPU configuration
                      • Reads runtime system information
                      PID:1511
                    • /bin/sh
                      sh -c "lsmod 2>/dev/null | grep -iE 'vmw|vbox|virtio|xen|hv_|vhost' | head -40"
                      2⤵
                        PID:1512
                        • /usr/bin/head
                          head -40
                          3⤵
                            PID:1515
                          • /bin/grep
                            grep -iE "vmw|vbox|virtio|xen|hv_|vhost"
                            3⤵
                              PID:1514
                            • /sbin/lsmod
                              lsmod
                              3⤵
                              • Reads list of loaded kernel modules
                              • Enumerates kernel/hardware configuration
                              • Reads runtime system information
                              PID:1513
                          • /bin/sh
                            sh -c "lspci -nn 2>/dev/null | grep -iE 'virtio|vmware|virtualbox|qxl|cirrus|1af4:|15ad:|80ee:' | head -40"
                            2⤵
                              PID:1516
                              • /usr/bin/head
                                head -40
                                3⤵
                                  PID:1519
                                • /bin/grep
                                  grep -iE "virtio|vmware|virtualbox|qxl|cirrus|1af4:|15ad:|80ee:"
                                  3⤵
                                    PID:1518
                                  • /usr/bin/lspci
                                    lspci -nn
                                    3⤵
                                    • Enumerates kernel/hardware configuration
                                    PID:1517
                                • /bin/sh
                                  sh -c "dmidecode -t bios 2>/dev/null | head -40"
                                  2⤵
                                    PID:1520
                                    • /usr/bin/head
                                      head -40
                                      3⤵
                                        PID:1522
                                      • /usr/sbin/dmidecode
                                        dmidecode -t bios
                                        3⤵
                                          PID:1521
                                      • /bin/sh
                                        sh -c "dmidecode -t system 2>/dev/null | head -40"
                                        2⤵
                                          PID:1523
                                          • /usr/bin/head
                                            head -40
                                            3⤵
                                              PID:1525
                                            • /usr/sbin/dmidecode
                                              dmidecode -t system
                                              3⤵
                                                PID:1524
                                            • /bin/sh
                                              sh -c "lsusb 2>/dev/null | head -40"
                                              2⤵
                                                PID:1526
                                                • /usr/bin/head
                                                  head -40
                                                  3⤵
                                                    PID:1528
                                                  • /usr/bin/lsusb
                                                    lsusb
                                                    3⤵
                                                    • Enumerates kernel/hardware configuration
                                                    • Peripheral Device Discovery
                                                    PID:1527
                                                • /bin/sh
                                                  sh -c "ip neigh 2>/dev/null | head -30 || arp -n 2>/dev/null | head -30"
                                                  2⤵
                                                  • System Network Configuration Discovery
                                                  PID:1530
                                                  • /usr/bin/head
                                                    head -30
                                                    3⤵
                                                      PID:1532
                                                    • /sbin/ip
                                                      ip neigh
                                                      3⤵
                                                      • System Network Configuration Discovery
                                                      PID:1531
                                                  • /tmp/2026-07-30_6d8b761a720ade7aefd7ec59e964d1b4_dosia_glassworm_poet-rat_qnapcrypt
                                                    /tmp/2026-07-30_6d8b761a720ade7aefd7ec59e964d1b4_dosia_glassworm_poet-rat_qnapcrypt --vmware-port-probe
                                                    2⤵
                                                      PID:1533
                                                    • /usr/bin/systemd-detect-virt
                                                      systemd-detect-virt
                                                      2⤵
                                                      • Checks hardware identifiers (DMI)
                                                      • Reads hardware information
                                                      • Checks CPU configuration
                                                      • Enumerates kernel/hardware configuration
                                                      • Reads runtime system information
                                                      PID:1538
                                                    • /usr/bin/systemd-detect-virt
                                                      systemd-detect-virt -c
                                                      2⤵
                                                      • Reads runtime system information
                                                      PID:1539
                                                    • /usr/bin/lspci
                                                      lspci -nn
                                                      2⤵
                                                      • Enumerates kernel/hardware configuration
                                                      PID:1540
                                                    • /usr/bin/lspci
                                                      lspci -nn
                                                      2⤵
                                                      • Enumerates kernel/hardware configuration
                                                      PID:1541
                                                    • /usr/bin/aplay
                                                      aplay -l
                                                      2⤵
                                                        PID:1542
                                                      • /sbin/ip
                                                        ip route
                                                        2⤵
                                                        • System Network Configuration Discovery
                                                        PID:1543
                                                      • /usr/bin/which
                                                        which wireshark
                                                        2⤵
                                                          PID:1544
                                                        • /usr/bin/which
                                                          which tshark
                                                          2⤵
                                                            PID:1545
                                                          • /usr/bin/which
                                                            which strace
                                                            2⤵
                                                              PID:1546
                                                            • /usr/bin/which
                                                              which ltrace
                                                              2⤵
                                                                PID:1547
                                                              • /usr/bin/which
                                                                which gdb
                                                                2⤵
                                                                  PID:1548
                                                                • /usr/bin/which
                                                                  which tcpdump
                                                                  2⤵
                                                                    PID:1549

                                                                Network

                                                                      MITRE ATT&CK Enterprise v16

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads