629dc3e537d611e2da7e5e0274900213e817d4057b344e6cb82bd95dee937d3b

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
08/08/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_136e4272b67c085beeafa548f8776193_dosia_glassworm_poet-rat_qnapcrypt
Size 10.9MB
Sample260808-cajj3abb46
SHA256 629dc3e537d611e2da7e5e0274900213e817d4057b344e6cb82bd95dee937d3b
MD5 136e4272b67c085beeafa548f8776193
SHA1 375d05f350e54e8030d92825a0379a6cf6e90e7b
SHA512 85d7ce4f215c3d04630141d3512f735abb14802e784e9df26652f838a061dc1823cbf1e675d5ccd0d74162ae14614ffda31549948b94ed9f91bf647d7d64fb82
SSDEEP 98304:RnN1FseB53drSD2TfXUrrsFdyAYyFBPyCEG7Z:VZ5SD2TfEP8dyAXIPG7Z
TLSH
T13EB64A07EC6605E8C0AED174CA7692627B317C495B3533E71B60B6342F73BE0A9BA354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-08-07_136e4272b67c085beeafa548f8776193_dosia_glassworm_poet-rat_qnapcrypt
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	2026-08-07_136e4272b67c085beeafa548f8776193_dosia_glassworm_poet-rat_qnapcrypt
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us	2026-08-07_136e4272b67c085beeafa548f8776193_dosia_glassworm_poet-rat_qnapcrypt

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/mountinfo	2026-08-07_136e4272b67c085beeafa548f8776193_dosia_glassworm_poet-rat_qnapcrypt
File opened for reading	/proc/self/cgroup	2026-08-07_136e4272b67c085beeafa548f8776193_dosia_glassworm_poet-rat_qnapcrypt

/tmp/2026-08-07_136e4272b67c085beeafa548f8776193_dosia_glassworm_poet-rat_qnapcrypt
/tmp/2026-08-07_136e4272b67c085beeafa548f8776193_dosia_glassworm_poet-rat_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1485

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads