ea0025af56128bde77fb05e1ea4080cfe243c27b49e8be6bebb90ac0776cb2c0

General

Target
2026-07-30_9d2c77d6180922af506c81ecd8c2e0ee_dosia_glassworm_poet-rat_qnapcrypt
Size 5.4MB
Sample260730-18d91ayblf
SHA256 ea0025af56128bde77fb05e1ea4080cfe243c27b49e8be6bebb90ac0776cb2c0
MD5 9d2c77d6180922af506c81ecd8c2e0ee
SHA1 523b4958b5f4d940a32887b275fc127871b5aab3
SHA512 c07b568524b4209daeed81433d817db46b92fda3c37a9610fe398e4811a1e96ce5dee7571d294028b1831d02479f48bd84d0ca2e163162a53f1f28a3bec36b7d
SSDEEP 49152:GteLKukUy/Y0KH0MJUCyReWZW3RUrYwCgX9TJ4LMPo5E+Y62gWoX9mIUsChcvSqJ:aeyMveWiX9TSEbsm1G5Jz
TLSH
T1A7463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-07-30_9d2c77d6180922af506c81ecd8c2e0ee_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 ea0025af56128bde77fb05e1ea4080cfe243c27b49e8be6bebb90ac0776cb2c0
- MD5 9d2c77d6180922af506c81ecd8c2e0ee
- SHA1 523b4958b5f4d940a32887b275fc127871b5aab3
- SHA512 c07b568524b4209daeed81433d817db46b92fda3c37a9610fe398e4811a1e96ce5dee7571d294028b1831d02479f48bd84d0ca2e163162a53f1f28a3bec36b7d
- SSDEEP 49152:GteLKukUy/Y0KH0MJUCyReWZW3RUrYwCgX9TJ4LMPo5E+Y62gWoX9mIUsChcvSqJ:aeyMveWiX9TSEbsm1G5Jz
- TLSH
  T1A7463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm defense_evasion discovery stealer
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Checks SCSI settings
  Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
behavioral1