0cd407972fe98dd51b135086f33eb6e2efb8a3fa50025fe3a52f19270a4d00d2

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
18/10/2026, 13:28

Target
2026-10-18_677711cc8998e58a2def9302722edaee_glassworm_poet-rat_qnapcrypt
Size 47.7MB
Sample261018-qq36asex21
SHA256 0cd407972fe98dd51b135086f33eb6e2efb8a3fa50025fe3a52f19270a4d00d2
MD5 677711cc8998e58a2def9302722edaee
SHA1 23c1776b657a24f648e92f031f04c8aae150ea25
SHA512 412716ff92a07a29b1e5a2a0ca404d7db61363f326e4cd67c02ae259ab5a2ae78a2434bc862db8b764b079bad5133b3a0d9da10ba60cef0a1cb9a7d1b1894ecf
SSDEEP 786432:tKMsbr/qizICBLdthE2q2qyDDDEChsShfBxu1jMZNPYg8JVRRzr4Zmbr2aOaG+uO:/+rbIgs4e
TLSH
T1ABB70856F8A614F6C5BEE03486896723BFB138E583313BD35FA09A751A25FD4663E300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-10-18_677711cc8998e58a2def9302722edaee_glassworm_poet-rat_qnapcrypt

/tmp/2026-10-18_677711cc8998e58a2def9302722edaee_glassworm_poet-rat_qnapcrypt
/tmp/2026-10-18_677711cc8998e58a2def9302722edaee_glassworm_poet-rat_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
PID:1501

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact