c2fda6c1a7fa4afedd6e319ac1545b620bb3ce6eb415b8f7ed6d60f9a54cf2dc

General

Target
2026-07-22_994410c177d612dcb70225fd0993a080_dosia_glassworm_poet-rat_qnapcrypt
Size 5.4MB
Sample260722-3jqmvaap7v
SHA256 c2fda6c1a7fa4afedd6e319ac1545b620bb3ce6eb415b8f7ed6d60f9a54cf2dc
MD5 994410c177d612dcb70225fd0993a080
SHA1 5d12a464da27b4fba65e4508d15cd27c7433d637
SHA512 fb94276a812b867b0496426f433c18967835a817fc658ebab16e5cc2eca5d76c981bb066d1d4990796c272304c0c63d3ad47d0278e897b7a1003f106666228fd
SSDEEP 49152:FteLKOkt8YQE3HoMJRSyw+WNo+y0rY6CgX9jBdGM3o5E+YB2gWoX9mIUsChcvSqw:LeHMHSoSX9j4ESsm1G5JG
TLSH
T15B463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-07-22_994410c177d612dcb70225fd0993a080_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 c2fda6c1a7fa4afedd6e319ac1545b620bb3ce6eb415b8f7ed6d60f9a54cf2dc
- MD5 994410c177d612dcb70225fd0993a080
- SHA1 5d12a464da27b4fba65e4508d15cd27c7433d637
- SHA512 fb94276a812b867b0496426f433c18967835a817fc658ebab16e5cc2eca5d76c981bb066d1d4990796c272304c0c63d3ad47d0278e897b7a1003f106666228fd
- SSDEEP 49152:FteLKOkt8YQE3HoMJRSyw+WNo+y0rY6CgX9jBdGM3o5E+YB2gWoX9mIUsChcvSqw:LeHMHSoSX9j4ESsm1G5JG
- TLSH
  T15B463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm defense_evasion discovery stealer
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Checks SCSI settings
  Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
behavioral1