General
- Target 2026-07-16_41a2c5a314903ecad95f664fc8513c25_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- Sample260716-1cntkaev6r
- SHA256 24c35dc3a38b36f45353fcb2dcacaad307c6edf313b4c98689211115df4b3f3f
Score
7/10
Malware Config
Targets
-
- Target 2026-07-16_41a2c5a314903ecad95f664fc8513c25_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 24c35dc3a38b36f45353fcb2dcacaad307c6edf313b4c98689211115df4b3f3f
Score7/10Reads EFI boot settings
Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
Checks SCSI settings
Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
Checks mountinfo of local process
Checks mountinfo of running processes which indicate if it is running in chroot jail.
Enumerates running processes
Discovers information about currently running processes on the system
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.
Reads list of loaded kernel modules
Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
MITRE ATT&CK Enterprise v16
Defense Evasion
Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
5System Checks
4