Analysis
- max time kernel
148s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
04/08/2026, 11:39
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-03_629798ff00ec7f0e493d9c843250533b_akira_glassworm
Resource
ubuntu1804-amd64-20260513-en
5 signatures
150 seconds
General
- Target 2026-08-03_629798ff00ec7f0e493d9c843250533b_akira_glassworm
- Size 2.7MB
- Sample260804-nsdbjsvwh1
- SHA256 f120cae18f5ef410b42fc78403fc3a34f26d4bb239f40c483f0d3bb76de6fa45
- MD5 629798ff00ec7f0e493d9c843250533b
- SHA1 d170503a9b67eb2839beeed652f5af91cd92792e
- SHA512 e210b901c45e38e40f07f5f59e26e3f3f339b72fe1ec035527b75e084dfa1ab9c345974687dd2559bfc28539b6f5168c97f15d831bdb09a2b556eda1b8a3ee27
- SSDEEP 49152:VibAsnjBjI6FF/BozQQAMFZ6Vq14i8afkzhIU6iZtEL7:AhroE7r0wW+Z
- TLSH T1ACD58C07F5B244ECD9BAC978824FD673E624B889421277273BDC5B102F26E25AF0D752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Reads MAC address of network interface 2 TTPs 1 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
description ioc Process File opened for reading /sys/class/net/ens3/address 2026-08-03_629798ff00ec7f0e493d9c843250533b_akira_glassworm - Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself tokio-runtime-w 1497 2026-08-03_629798ff00ec7f0e493d9c843250533b_akira_glassworm Changes the process name, possibly in an attempt to hide itself tokio-runtime-w 1498 2026-08-03_629798ff00ec7f0e493d9c843250533b_akira_glassworm - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo 2026-08-03_629798ff00ec7f0e493d9c843250533b_akira_glassworm - Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/cgroup/cpu/cpu.cfs_quota_us 2026-08-03_629798ff00ec7f0e493d9c843250533b_akira_glassworm File opened for reading /sys/fs/cgroup/cpu/cpu.cfs_period_us 2026-08-03_629798ff00ec7f0e493d9c843250533b_akira_glassworm File opened for reading /sys/class/net 2026-08-03_629798ff00ec7f0e493d9c843250533b_akira_glassworm -
description ioc Process File opened for reading /proc/self/cgroup 2026-08-03_629798ff00ec7f0e493d9c843250533b_akira_glassworm
Processes
-
/tmp/2026-08-03_629798ff00ec7f0e493d9c843250533b_akira_glassworm/tmp/2026-08-03_629798ff00ec7f0e493d9c843250533b_akira_glassworm1⤵
- Reads MAC address of network interface
- Changes its process name
- Checks CPU configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1494