Analysis
- max time kernel
149s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
01/08/2026, 03:46
Static task
static1
General
- Target 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm
- Size 3.5MB
- Sample260801-ebmdfsxcnd
- SHA256 0f897dc920dca54b545bb413454767ec1707c907f5916e8d4f6da4cf94d777a0
- MD5 1428400c54d6617abe2dc8e7f01ccb3a
- SHA1 41fa4546ee67574c4cbe7ba80291eb9aca6114ec
- SHA512 bedeb4eccfeeb0889023e317d0e4d6570de0443dc0f061aae65c0a3d6e01c43136abd0697126c63a1b870c06a025c995bcce053dc93e7b99c52f3b302a77f02f
- SSDEEP 49152:EvJj2UJm6cTvBGLU2jFyZJp9ZyW6qH2Brethbl3Gmy7FWSvJDgrgTfZEBwIU6iNz:EvpmviBFyB7nRuWADgEiBP+No
- TLSH T17CF58D47F6A104AED9BFC974824FE773D724B4854216B3273BD49B113E2AA20AF0D791
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself tokio-runtime-w 1487 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm - Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/cpu0/cpufreq/scaling_cur_freq 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /sys/devices/system/cpu/online 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm - Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/cpu/cpu.cfs_quota_us 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /sys/fs/cgroup/cpu/cpu.cfs_period_us 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm -
description ioc Process File opened for reading /proc/1186/task/1212/statm 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1291/task/1318/environ 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1339/task/1349/task 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/422/task/427/status 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/658/task/663/status 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/908/task/910/environ 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/967/task/980/environ 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/983/task/997/cmdline 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1006/task/1008/statm 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1339/environ 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/405/statm 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/500/task/506/environ 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1331/environ 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/25/status 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/28/task 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/31/io 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/172/status 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/717/task/915/cmdline 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/983/task/986/environ 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1091/task/1133/environ 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1187/task/1192/statm 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/900/task/904/environ 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1032/stat 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1051/status 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1291/task/1329/io 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1443/statm 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/18/task 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/170/cmdline 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1032/task/1035/cmdline 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1146/statm 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1186/task/1255/stat 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1331/task/1333/io 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/14/statm 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/162/status 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/202/io 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/669/task/673/status 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/669/task/673/statm 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/967/task/981/task 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1006/task/1009/stat 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1041/task/1042/cmdline 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/159/cmdline 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/462/task 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/609/statm 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/968/environ 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/974/task/977/cmdline 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1006/task/1008/task 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1051/io 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1074/io 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/80/task 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/478/environ 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/536/task 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1291/task/1318/statm 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1331/task/1336/stat 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1474/task 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1086/status 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1291/io 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1331/task/1333/cmdline 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/241/stat 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1051/task/1059/stat 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1067/task/1070/cmdline 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1443/task/1450/cmdline 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1483/task/1486/io 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/10/status 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm File opened for reading /proc/1094/task/1117/task 2026-08-01_1428400c54d6617abe2dc8e7f01ccb3a_akira_glassworm