0bcbeac2f3b4097023415c748d6494146ba8a15cfa6fe8961b53548564710819

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
30/10/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_65111a8937e314f682a4afcc79f58e16_dosia_glassworm_poet-rat_qnapcrypt
Size 9.7MB
Sample261030-dnnllsdb45
SHA256 0bcbeac2f3b4097023415c748d6494146ba8a15cfa6fe8961b53548564710819
MD5 65111a8937e314f682a4afcc79f58e16
SHA1 aea4e70c0ee88d1da93b6c740fc2f54294b05e05
SHA512 a11bb2bcdc3c2768a1497a10d51d966c6e4786eebbe43c9f9b6f843ebf9b4b612f2d0a21c19b2d695f801ca328f2808a682418640bb7cca7ab8fd0f478e01dd2
SSDEEP 98304:UCDe1hO+WLh1hmNbLlalrE7CD+B+0siaNYgt8TK63C3LA3wN3EF:neDXWF4b4rE+Dg+ui0F
TLSH
T121A6394BECA555E4C4FDD1348AB29652BB717C4A1B3023D72B50F6282F73BD0AAB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-10-28_65111a8937e314f682a4afcc79f58e16_dosia_glassworm_poet-rat_qnapcrypt
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	2026-10-28_65111a8937e314f682a4afcc79f58e16_dosia_glassworm_poet-rat_qnapcrypt
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us	2026-10-28_65111a8937e314f682a4afcc79f58e16_dosia_glassworm_poet-rat_qnapcrypt

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/cgroup	2026-10-28_65111a8937e314f682a4afcc79f58e16_dosia_glassworm_poet-rat_qnapcrypt
File opened for reading	/proc/self/mountinfo	2026-10-28_65111a8937e314f682a4afcc79f58e16_dosia_glassworm_poet-rat_qnapcrypt

/tmp/2026-10-28_65111a8937e314f682a4afcc79f58e16_dosia_glassworm_poet-rat_qnapcrypt
/tmp/2026-10-28_65111a8937e314f682a4afcc79f58e16_dosia_glassworm_poet-rat_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1521

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads