f40c5ac40752f7d5e6738a6f0f0c3b2b62e56e808c7c27396b1f0bb08d237ae9

General

Target
2026-08-02_ab168b020b036d5fc941171d5f3a1036_dosia_glassworm_poet-rat_qnapcrypt
Size 5.4MB
Sample260802-3xgbbstglh
SHA256 f40c5ac40752f7d5e6738a6f0f0c3b2b62e56e808c7c27396b1f0bb08d237ae9
MD5 ab168b020b036d5fc941171d5f3a1036
SHA1 662564158e6c52a573f214e0141c3218f60ffa2b
SHA512 84739b43c0326a665d674fdb92b9634cc7a7162d385c84972ce75722cbc6100e58e1bbf320a37ae731747b1aec4f12c7e226d972ff63aaa5d077d9a0f79b09ef
SSDEEP 49152:EheLOGEU8/hZ3HNMJxMyReiRWNh0rYjCgXVlJpfM3o5E+YT2gWoX9mIUsChcvSq4:UeSMmKWvXVl/Eosm1G5Je
TLSH
T1BE463A53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-08-02_ab168b020b036d5fc941171d5f3a1036_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 f40c5ac40752f7d5e6738a6f0f0c3b2b62e56e808c7c27396b1f0bb08d237ae9
- MD5 ab168b020b036d5fc941171d5f3a1036
- SHA1 662564158e6c52a573f214e0141c3218f60ffa2b
- SHA512 84739b43c0326a665d674fdb92b9634cc7a7162d385c84972ce75722cbc6100e58e1bbf320a37ae731747b1aec4f12c7e226d972ff63aaa5d077d9a0f79b09ef
- SSDEEP 49152:EheLOGEU8/hZ3HNMJxMyReiRWNh0rYjCgXVlJpfM3o5E+YT2gWoX9mIUsChcvSq4:UeSMmKWvXVl/Eosm1G5Je
- TLSH
  T1BE463A53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm defense_evasion discovery stealer
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Checks SCSI settings
  Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
behavioral1