457370298b15245ff6d2c9c056b4900b39e3a43532312417d4c162dcab54d024

General

Target
2026-07-28_14e1c31186c414c5de94dd2277648067_dosia_glassworm_poet-rat_qnapcrypt
Size 5.4MB
Sample260729-b7plxaen2v
SHA256 457370298b15245ff6d2c9c056b4900b39e3a43532312417d4c162dcab54d024
MD5 14e1c31186c414c5de94dd2277648067
SHA1 e479aa71a96e7418f572a733f02685c1942e0ab8
SHA512 8cc690d3d106fb980af816d01c2c5bb200c7cbc91e18db2f2cd6e2adf29046c95fdedf60c2ee6b6f4feb8fd693d38210c815d2d90ee776d2cf52dd468bbf9261
SSDEEP 49152:+teLKukUy/Y0KH0MJUCyReWZW3RUrYwCgX9TJ4LMPo5E+Yo2gWoX9mIUsChcvSq/:yeyMveWiX9TSENsm1G5JF
TLSH
T136463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-07-28_14e1c31186c414c5de94dd2277648067_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 457370298b15245ff6d2c9c056b4900b39e3a43532312417d4c162dcab54d024
- MD5 14e1c31186c414c5de94dd2277648067
- SHA1 e479aa71a96e7418f572a733f02685c1942e0ab8
- SHA512 8cc690d3d106fb980af816d01c2c5bb200c7cbc91e18db2f2cd6e2adf29046c95fdedf60c2ee6b6f4feb8fd693d38210c815d2d90ee776d2cf52dd468bbf9261
- SSDEEP 49152:+teLKukUy/Y0KH0MJUCyReWZW3RUrYwCgX9TJ4LMPo5E+Yo2gWoX9mIUsChcvSq/:yeyMveWiX9TSENsm1G5JF
- TLSH
  T136463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm defense_evasion discovery stealer
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Checks SCSI settings
  Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
behavioral1