Analysis
- max time kernel
120s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20261019-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
10/11/2026, 16:27
Static task
static1
Behavioral task
behavioral1
Sample
2026-11-09_7056e3d3ce36c7c2b82c2a2d94c7f20a_dosia_glassworm_poet-rat_qnapcrypt
Resource
ubuntu1804-amd64-20261019-en
2 signatures
150 seconds
General
- Target 2026-11-09_7056e3d3ce36c7c2b82c2a2d94c7f20a_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.8MB
- Sample261110-tycj4agg23
- SHA256 0f0cc28ffa2c9a332b86d3073a5ac9933cc01cb3a3ca40c2150c9029c1bcb7ea
- MD5 7056e3d3ce36c7c2b82c2a2d94c7f20a
- SHA1 6c238c9eeb26159274b0c0da25c0e36d737d7bca
- SHA512 c231d427ab73180fb1fe93f123018f7f5b16a78bcbbb061c7da68b8ee8f9283af5780f4c239eb5b43fcb8feed3ffd27ba5554e152253bd148f943a7b10c645af
- SSDEEP 49152:ygYdi9IWl4SRqwpX8NeTiWiSCXfOoBb90vUA3oEPpGCNsIUXhR7J+OWJzemXE1HQ:yfUXKomtXBB0n3okh67GE1k00SYEqB
- TLSH T116565A43ECA555E8C0AAE1318A629253BB717C885F3123D33B90F7782F76BD06AB5750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size 2026-11-09_7056e3d3ce36c7c2b82c2a2d94c7f20a_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_quota_us 2026-11-09_7056e3d3ce36c7c2b82c2a2d94c7f20a_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /sys/fs/cgroup/cpu,cpuacct/cpu.cfs_period_us 2026-11-09_7056e3d3ce36c7c2b82c2a2d94c7f20a_dosia_glassworm_poet-rat_qnapcrypt -
description ioc Process File opened for reading /proc/self/mountinfo 2026-11-09_7056e3d3ce36c7c2b82c2a2d94c7f20a_dosia_glassworm_poet-rat_qnapcrypt File opened for reading /proc/self/cgroup 2026-11-09_7056e3d3ce36c7c2b82c2a2d94c7f20a_dosia_glassworm_poet-rat_qnapcrypt