Overview

overview

3

Static

static

1

2026-09-29...pcrypt

ubuntu-18.04-amd64

3

Analysis

  • max time kernel
    0s
  • max time network
    131s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    30/09/2026, 04:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_1f2d09359beb82583a29ebe236530800_dosia_glassworm_poet-rat_qnapcrypt
  • Size 40.0MB
  • Sample260930-e81bkssxdz
  • SHA256 ea857a3f0f7d4276cf5848b236542c5048e2eaa7bdd1b6ddec238f8793e74bff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/2026-09-29_1f2d09359beb82583a29ebe236530800_dosia_glassworm_poet-rat_qnapcrypt
    /tmp/2026-09-29_1f2d09359beb82583a29ebe236530800_dosia_glassworm_poet-rat_qnapcrypt
    1⤵
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to tmp directory
    PID:1514

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        device-id.tmp.1901275306
        • Path /tmp/.local/state/gh/device-id.tmp.1901275306
        • Size 36B
        • SHA256 7d50ac1942457293eb52f074e97a472fe4ad4d143b2464d662a2ce3ffefc3166
        • MD5 SHA1 SHA512
        Submit Download