Overview

overview

10

Static

static

5

2026-09-24...pcrypt

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    25/09/2026, 16:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_02730ec523e55cb35cb6a62e320f107b_glassworm_poet-rat_qnapcrypt
  • Size 7.2MB
  • Sample260925-tglrfafd87
  • SHA256 0b4b099960d2ba8813e3e3a628c896761ed50473bf334ce668238083f2846a30
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
antivmdiscoveryxmrigminerupx

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 1 IoCs
    miner
  • Executes dropped EXE 1 IoCs
  • Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Reads hardware information 1 TTPs 14 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 46 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 25 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 7 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/2026-09-24_02730ec523e55cb35cb6a62e320f107b_glassworm_poet-rat_qnapcrypt
    /tmp/2026-09-24_02730ec523e55cb35cb6a62e320f107b_glassworm_poet-rat_qnapcrypt
    1⤵
    • Executes dropped EXE
    • Enumerates kernel/hardware configuration
    • Writes file to tmp directory
    PID:1491
    • /tmp/python3
      "[kworker/0:1]"
      2⤵
      • Checks hardware identifiers (DMI)
      • Reads hardware information
      • Checks CPU configuration
      • Reads CPU attributes
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:1504

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .nvramd
        • Path /tmp/.nvramd
        • Size 4B
        • SHA256 755917ecbc61091ffa6b605d7f82bdaa4e4cbdc309124807b0fb63228d0696df
        • MD5 SHA1 SHA512
        Submit Download

        python3
        • Path /tmp/python3
        • Size 2.5MB
        • SHA256 2d783cdcd7a74456aceb6bfb4c180bd9855848a9a7a0f54abd9ce1ac4192c2d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download