0c02637d2ec54d680d8d9401a4cff52b9dd0120f35ac29a7f2800731675136e9

Analysis

max time kernel
149s
max time network
148s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
05/09/2026, 05:53

Target
2026-09-04_7c36f69c3f5a3ee38e2820cc610fef50_glassworm_poet-rat_qnapcrypt_vshell
Size 7.2MB
Sample260905-glcm4scb33
SHA256 0c02637d2ec54d680d8d9401a4cff52b9dd0120f35ac29a7f2800731675136e9
MD5 7c36f69c3f5a3ee38e2820cc610fef50
SHA1 7a16fa99bf2880c29da28e943cfd80f2846e2d83
SHA512 d881401205db2fc3d2e52f9ee429db2e463b2ffbfd8dd4f67911405c19fb154dc3e757f5cbf0473f4b7c007478a0a312002b2dbb06380f736f67fb95302183b0
SSDEEP 98304:eZikJOkdNxLTPqjO1qyifjSF2PFlE9g0:wokdfjk738n
TLSH
T14F761860FACF14F6D9031D3015ABA23F27315D098B28DBD7EA447F29E93B6A6183611D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-09-04_7c36f69c3f5a3ee38e2820cc610fef50_glassworm_poet-rat_qnapcrypt_vshell

/tmp/2026-09-04_7c36f69c3f5a3ee38e2820cc610fef50_glassworm_poet-rat_qnapcrypt_vshell
/tmp/2026-09-04_7c36f69c3f5a3ee38e2820cc610fef50_glassworm_poet-rat_qnapcrypt_vshell
1⤵
- Enumerates kernel/hardware configuration
PID:1507

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact