6fb837a97ceb5af8e7484839681fb5418e792c6b9e6a250a13bb05406e268c42

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
12/08/2026, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_8c3c81aa4ef6e26b9569fcde7ed12237_akira_glassworm_zxxz
Size 34.2MB
Sample260812-khx2esdk21
SHA256 6fb837a97ceb5af8e7484839681fb5418e792c6b9e6a250a13bb05406e268c42
MD5 8c3c81aa4ef6e26b9569fcde7ed12237
SHA1 059a73ea3333b20911e6c7a06b05bb0e7c0d33f1
SHA512 7c8f7c78b1c96bad2d81ac583efa43a2082e1738b1945fe64c859abec93b9ca0c6cfe13fc8a8ad835c7eeccee64974a02d1471316c283a767d81e7b01a5abb4c
SSDEEP 196608:YIIP6xgFFcNG5D2sp5Yhj76ysYD6DHdcFf681BHDXHav542dLdqIAaPdlBh:oGgTcNGhjb8ShLdqIZlBh
TLSH
T19D774C13FE71446AE9A9C8354219B523E730B80B83103BEB7BC95A103F19BE15FB9759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	fbuild-main	1546	2026-08-12_8c3c81aa4ef6e26b9569fcde7ed12237_akira_glassworm_zxxz
Changes the process name, possibly in an attempt to hide itself	tokio-rt-worker	1547	2026-08-12_8c3c81aa4ef6e26b9569fcde7ed12237_akira_glassworm_zxxz
Changes the process name, possibly in an attempt to hide itself	tokio-rt-worker	1548	2026-08-12_8c3c81aa4ef6e26b9569fcde7ed12237_akira_glassworm_zxxz

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/cpu/cpu.cfs_quota_us	2026-08-12_8c3c81aa4ef6e26b9569fcde7ed12237_akira_glassworm_zxxz
File opened for reading	/sys/fs/cgroup/cpu/cpu.cfs_period_us	2026-08-12_8c3c81aa4ef6e26b9569fcde7ed12237_akira_glassworm_zxxz

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/cgroup	2026-08-12_8c3c81aa4ef6e26b9569fcde7ed12237_akira_glassworm_zxxz

/tmp/2026-08-12_8c3c81aa4ef6e26b9569fcde7ed12237_akira_glassworm_zxxz
/tmp/2026-08-12_8c3c81aa4ef6e26b9569fcde7ed12237_akira_glassworm_zxxz
1⤵
- Changes its process name
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1545

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads