743eb9810f34060335cae776fff959fe272f4421c60e4ac625ac1d77c8aaef80

Analysis

max time kernel
149s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
01/11/2026, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_c4b5163b605bd9f435ee0012875e41ab_dosia_glassworm_poet-rat_qnapcrypt_sliver
Size 21.6MB
Sample261101-zb1laszv2m
SHA256 743eb9810f34060335cae776fff959fe272f4421c60e4ac625ac1d77c8aaef80
MD5 c4b5163b605bd9f435ee0012875e41ab
SHA1 64854d419248ca8c993c4e42c519a95f40d2ec38
SHA512 0b3f0b2234862ebd34bbd3f351aca8281cc31833d06e5b99cb78b9ae6d67699c99465f269406eed603d936740953ba9f1514ad259ff6060fe9e74b4d24a42d67
SSDEEP 196608:hKfyyu46PD3Mox7n04yUaT0XpcXiSqfOYbo2PSCb:dS6l1n04ow5n7fDSCb
TLSH
T1D2379D47FC9605A4C1EEC1308877A1263B717C4A4B2563DB0B50BA787FB3BD8AA79354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us	2026-10-31_c4b5163b605bd9f435ee0012875e41ab_dosia_glassworm_poet-rat_qnapcrypt_sliver
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us	2026-10-31_c4b5163b605bd9f435ee0012875e41ab_dosia_glassworm_poet-rat_qnapcrypt_sliver
File opened for reading	/sys/kernel/mm/hugepages	2026-10-31_c4b5163b605bd9f435ee0012875e41ab_dosia_glassworm_poet-rat_qnapcrypt_sliver
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-10-31_c4b5163b605bd9f435ee0012875e41ab_dosia_glassworm_poet-rat_qnapcrypt_sliver

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/cgroup	2026-10-31_c4b5163b605bd9f435ee0012875e41ab_dosia_glassworm_poet-rat_qnapcrypt_sliver
File opened for reading	/proc/self/mountinfo	2026-10-31_c4b5163b605bd9f435ee0012875e41ab_dosia_glassworm_poet-rat_qnapcrypt_sliver

/tmp/2026-10-31_c4b5163b605bd9f435ee0012875e41ab_dosia_glassworm_poet-rat_qnapcrypt_sliver
/tmp/2026-10-31_c4b5163b605bd9f435ee0012875e41ab_dosia_glassworm_poet-rat_qnapcrypt_sliver
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1511

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads