9a5ba98a15c35623906244b8bf10bf4ec41c604091abe42cff571df05510dd32

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
27/10/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_fe48a1f376548bc1edd9d1ec6a92ae86_dosia_glassworm_poet-rat_qnapcrypt
Size 22.4MB
Sample261027-bcgmtacd38
SHA256 9a5ba98a15c35623906244b8bf10bf4ec41c604091abe42cff571df05510dd32
MD5 fe48a1f376548bc1edd9d1ec6a92ae86
SHA1 8f70a654d79a44897e6f08b2e2be107c78aaafe6
SHA512 06847ce9515154a6aafa951c524e683ddf25f234cfa17384f336c78bcfa880d377edce115b2a425764e82dddc15887cb542b7a619fca5244ecac3f8c3b05b260
SSDEEP 98304:qjV6KVMoN/gTEGPMq4dPHPnurquBl9K4RmPg4ozegdOONDD+titVKFZ74Ed:s1CoN/ggNrPnurLrzegjNDD+tikZ7xd
TLSH
T11D377C13FA6501B5C19AC130CA6A81527B30BC8A573173E7BB9CF2283F667D495BB790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-10-26_fe48a1f376548bc1edd9d1ec6a92ae86_dosia_glassworm_poet-rat_qnapcrypt
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	2026-10-26_fe48a1f376548bc1edd9d1ec6a92ae86_dosia_glassworm_poet-rat_qnapcrypt
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us	2026-10-26_fe48a1f376548bc1edd9d1ec6a92ae86_dosia_glassworm_poet-rat_qnapcrypt

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/cgroup	2026-10-26_fe48a1f376548bc1edd9d1ec6a92ae86_dosia_glassworm_poet-rat_qnapcrypt
File opened for reading	/proc/self/mountinfo	2026-10-26_fe48a1f376548bc1edd9d1ec6a92ae86_dosia_glassworm_poet-rat_qnapcrypt

/tmp/2026-10-26_fe48a1f376548bc1edd9d1ec6a92ae86_dosia_glassworm_poet-rat_qnapcrypt
/tmp/2026-10-26_fe48a1f376548bc1edd9d1ec6a92ae86_dosia_glassworm_poet-rat_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1538

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads