Overview

overview

7

Static

static

1

2026-08-04...pcrypt

ubuntu-18.04-amd64

7

Analysis

  • max time kernel
    92s
  • max time network
    146s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    04/08/2026, 23:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_49bc477f84a88fcb0a08041f9c41e9c0_dosia_glassworm_poet-rat_qnapcrypt
  • Size 7.0MB
  • Sample260804-21syvsfn21
  • SHA256 7d07900ae98f5b8998fc774266d9e73929704f4350909405acae91eb44847265
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 2 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Modifies Bash startup script 2 TTPs 2 IoCs
    persistence
  • Creates a desktop entry file 3 TTPs 1 IoCs

    A .desktop file is used by desktop environments to register and launch applications. This can be abused to gain persistence.

    persistenceexecution
  • Reads CPU attributes 1 TTPs 1 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 6 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/2026-08-04_49bc477f84a88fcb0a08041f9c41e9c0_dosia_glassworm_poet-rat_qnapcrypt
    /tmp/2026-08-04_49bc477f84a88fcb0a08041f9c41e9c0_dosia_glassworm_poet-rat_qnapcrypt
    1⤵
    • Executes dropped EXE
    • Enumerates kernel/hardware configuration
    PID:1541
    • /var/lib/.cache/gvfsd/gvfsd-helper
      /var/lib/.cache/gvfsd/gvfsd-helper
      2⤵
      • Creates/modifies environment variables
      • Modifies rc script
      • Modifies systemd
      • Modifies Bash startup script
      • Creates a desktop entry file
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:1547
      • /usr/bin/pgrep
        pgrep -x gvfsd-helper
        3⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1551
      • /usr/bin/crontab
        crontab -l
        3⤵
          PID:1555
        • /usr/bin/crontab
          crontab -
          3⤵
          • Creates/modifies Cron job
          PID:1556
        • /bin/systemctl
          systemctl daemon-reload
          3⤵
          • Reads runtime system information
          PID:1557
        • /bin/systemctl
          systemctl enable --now dbus-org.freedesktop.cache.service
          3⤵
          • Reads runtime system information
          PID:1578

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Scheduled Task/Job

          1
          T1053

          Cron

          1
          T1053.003

          User Execution

          2
          T1204

          Malicious File

          1
          T1204.002

          Persistence

          Boot or Logon Autostart Execution

          4
          T1547

          XDG Autostart Entries

          2
          T1547.013

          Boot or Logon Initialization Scripts

          1
          T1037

          RC Scripts

          1
          T1037.004

          Create or Modify System Process

          1
          T1543

          Systemd Service

          1
          T1543.002

          Event Triggered Execution

          1
          T1546

          Unix Shell Configuration Modification

          1
          T1546.004

          Hijack Execution Flow

          1
          T1574

          Path Interception by PATH Environment Variable

          1
          T1574.007

          Scheduled Task/Job

          1
          T1053

          Cron

          1
          T1053.003

          Privilege Escalation

          Boot or Logon Autostart Execution

          4
          T1547

          XDG Autostart Entries

          2
          T1547.013

          Boot or Logon Initialization Scripts

          1
          T1037

          RC Scripts

          1
          T1037.004

          Create or Modify System Process

          1
          T1543

          Systemd Service

          1
          T1543.002

          Event Triggered Execution

          1
          T1546

          Unix Shell Configuration Modification

          1
          T1546.004

          Hijack Execution Flow

          1
          T1574

          Path Interception by PATH Environment Variable

          1
          T1574.007

          Scheduled Task/Job

          1
          T1053

          Cron

          1
          T1053.003

          Defense Evasion

          Hijack Execution Flow

          1
          T1574

          Path Interception by PATH Environment Variable

          1
          T1574.007

          Credential Access

          Discovery

          System Information Discovery

          2
          T1082

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          dbus-org.freedesktop.cache.service
          • Path /etc/systemd/system/dbus-org.freedesktop.cache.service
          • Size 215B
          • SHA256 ff829af59951c2118934b1775bfa93d1429d4d3d8585701ce2e33582be662cde
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dbus-org.freedesktop.cache.desktop
          • Path /root/.config/autostart/dbus-org.freedesktop.cache.desktop
          • Size 156B
          • SHA256 55f4f997c72942ebc03a19259b22ef121763ef77c876bd1b4e805a810c1ae743
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          gvfsd-helper.lock
          • Path /run/gvfsd-helper.lock
          • Size 4B
          • SHA256 05fb3c9a7f20d8c60ade227ba6ed41510428c5d3e3847eac78eb486b06d2fae4
          • MD5 SHA1 SHA512
          Submit Download

          gvfsd-helper
          • Path /var/lib/.cache/gvfsd/gvfsd-helper
          • Size 7.0MB
          • SHA256 7d07900ae98f5b8998fc774266d9e73929704f4350909405acae91eb44847265
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tmp.MNgFTq
          • Path /var/spool/cron/crontabs/tmp.MNgFTq
          • Size 362B
          • SHA256 d14870af5234ac0a2e09dc08741d6041ed1badb85f0d6b6c7a55b75f2986fd6a
          • MD5 SHA1 SHA512 TLSH
          Submit Download