ab2d99b8086c52141025dc1430d06337e754e0fa9a9989e7f24b7cfd0be52561

Analysis

max time kernel
149s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
07/11/2026, 15:17

Target
2026-11-07_3a794ef1d50945bda4377751d5f16ee2_dosia_glassworm_poet-rat_qnapcrypt
Size 7.9MB
Sample261107-spesesfc45
SHA256 ab2d99b8086c52141025dc1430d06337e754e0fa9a9989e7f24b7cfd0be52561
MD5 3a794ef1d50945bda4377751d5f16ee2
SHA1 d7122e4a798431bf16d56270ac5d7471c7a6b6e8
SHA512 bf86cd9bd4597683a9c9947d92decffe8b44b29029660623bca678bfc2f46c648465554c4c98d5d8e8ec38b8aad72baf932614088b8c2ed9fb8681c15b309a11
SSDEEP 98304:1HncIxw6F0pElSV6RuN6eBEwlbU+qEgfng2Na8F1XWA:Zw6FvvuNT+wkEqnguVT
TLSH
T1C5868D07FCA555E9C0EA92308A629253BA71BC491B3027D33B60F7392F76BD46E79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	2026-11-07_3a794ef1d50945bda4377751d5f16ee2_dosia_glassworm_poet-rat_qnapcrypt

/tmp/2026-11-07_3a794ef1d50945bda4377751d5f16ee2_dosia_glassworm_poet-rat_qnapcrypt
/tmp/2026-11-07_3a794ef1d50945bda4377751d5f16ee2_dosia_glassworm_poet-rat_qnapcrypt
1⤵
- Enumerates kernel/hardware configuration
PID:1571

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact