General
- Target 2026-05-30_c07c3624df06459b504d2225ff3e4771_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.5MB
- Sample260530-kqaabsaz2m
- SHA256 83ec23b14eccb69ad7dc8184c9c658835c800be7ba846f41f357602e0673b7b8
- MD5 c07c3624df06459b504d2225ff3e4771
- SHA1 343756f2f81c60348b2acfb2f4e52a7df5160077
- SHA512 0b78a6be73c7f5e146aad544e74d28cce50c1ceaab9bf26aea3032330991677505895c042744ba7e9646a2af8cef039c4a09186001a9f9969a06ba8a12abdf63
- SSDEEP 49152:z3aCaA2aox6R6//NBGWMf3fFx9F30Si5J9otX3KzgqsmJSaeH5Ew:rba5fkK/NBGPri5J9QsWEw
- TLSH T18B462811FE8B54F6E9031D3015BBA26F63315D058F24EBD7EA547F2AF97BA910832209
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-05-30_c07c3624df06459b504d2225ff3e4771_dosia_glassworm_poet-rat_qnapcrypt
Resource
ubuntu1804-amd64-20260513-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-30_c07c3624df06459b504d2225ff3e4771_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.5MB
- SHA256 83ec23b14eccb69ad7dc8184c9c658835c800be7ba846f41f357602e0673b7b8
- MD5 c07c3624df06459b504d2225ff3e4771
- SHA1 343756f2f81c60348b2acfb2f4e52a7df5160077
- SHA512 0b78a6be73c7f5e146aad544e74d28cce50c1ceaab9bf26aea3032330991677505895c042744ba7e9646a2af8cef039c4a09186001a9f9969a06ba8a12abdf63
- SSDEEP 49152:z3aCaA2aox6R6//NBGWMf3fFx9F30Si5J9otX3KzgqsmJSaeH5Ew:rba5fkK/NBGPri5J9QsWEw
- TLSH T18B462811FE8B54F6E9031D3015BBA26F63315D058F24EBD7EA547F2AF97BA910832209
- MD5 SHA1 SHA512 SSDEEP TLSH
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
Write file to user bin folder
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Scheduled Task/Job
1Cron
1