0d327ced577b77dacb43207cb1521672799e7813532615e92142ea42e729d1a1

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
11/10/2026, 23:21

Target
2026-10-09_a0385cc0fdfcd05053c06c3f1fd5d2c7_dosia_glassworm_qnapcrypt_sliver
Size 4.9MB
Sample261011-3b14lsbb28
SHA256 0d327ced577b77dacb43207cb1521672799e7813532615e92142ea42e729d1a1
MD5 a0385cc0fdfcd05053c06c3f1fd5d2c7
SHA1 8c64ad1b80e41d0da5f219c34baaf08fe2d31f0c
SHA512 60946896588ecd63c06b6adeee79c0405e4eff5d22474147b71009c9351e4151c5172bbdb831846545cbf9ce578ccfd01ab3dccb095d8ab39d584bb296a9199c
SSDEEP 49152:Mwf9HK/IKUdrb/TtvO90d7HjmAFd4A64nsfJyBixpl+rX0Fbptl35E+pa140gqcs:/Kx4EEUxfMbYw
TLSH
T1E7364B87F9901199C0AAD335CA665362A7713C881F3063D77B60BBBC2E32BD49E76354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-10-09_a0385cc0fdfcd05053c06c3f1fd5d2c7_dosia_glassworm_qnapcrypt_sliver

/tmp/2026-10-09_a0385cc0fdfcd05053c06c3f1fd5d2c7_dosia_glassworm_qnapcrypt_sliver
/tmp/2026-10-09_a0385cc0fdfcd05053c06c3f1fd5d2c7_dosia_glassworm_qnapcrypt_sliver
1⤵
- Enumerates kernel/hardware configuration
PID:1542

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact