4e1af7944c8ccdc936bd4c209e02f048e6f9e00368fbb8371ac669b9f3370eeb

Analysis

max time kernel
149s
max time network
148s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
05/09/2026, 19:35

Target
2026-09-04_04ba3999e8530a3cca0dec4a4e40eabb_dosia_glassworm_poet-rat_qnapcrypt_sliver_vshell
Size 7.6MB
Sample260905-yarrbs1elf
SHA256 4e1af7944c8ccdc936bd4c209e02f048e6f9e00368fbb8371ac669b9f3370eeb
MD5 04ba3999e8530a3cca0dec4a4e40eabb
SHA1 24a04e89e2440aec26499ca3e0412d4ded38e87e
SHA512 9b1e00b3583dcc0409f980e025385051fc79fc3da84e154690ed7a61e77585d191b40e4e2616110760d6667303caea79e572fee8c4bb2d17c89f138d16d154a1
SSDEEP 49152:Qtps6v6SMU1frb/ThvO90d7HjmAFd4A64nsfJkE71ZXJa7HSI8Sr3hgoHWcn4bM4:oM4NC1n4H6MNLL0wNKBwpEBre15ZOj
TLSH
T175860847F89181E9C0EED134C6669262BA707C895B3023E73B50F7B42B36BD46E7A354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-09-04_04ba3999e8530a3cca0dec4a4e40eabb_dosia_glassworm_poet-rat_qnapcrypt_sliver_vshell

/tmp/2026-09-04_04ba3999e8530a3cca0dec4a4e40eabb_dosia_glassworm_poet-rat_qnapcrypt_sliver_vshell
/tmp/2026-09-04_04ba3999e8530a3cca0dec4a4e40eabb_dosia_glassworm_poet-rat_qnapcrypt_sliver_vshell
1⤵
- Enumerates kernel/hardware configuration
PID:1543

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact