e2c4bdcb20b9a93913375f6a603797c46dfb2b46305d5b683b94dacbccd68c86

General

Target
2026-08-01_3f45fbf2a1d4b3abd661714e9885b155_dosia_glassworm_poet-rat_qnapcrypt
Size 5.4MB
Sample260802-a95v8sar2y
SHA256 e2c4bdcb20b9a93913375f6a603797c46dfb2b46305d5b683b94dacbccd68c86
MD5 3f45fbf2a1d4b3abd661714e9885b155
SHA1 3453b8fbcea99ad256e37271b9cf5e7f81f3d8e6
SHA512 4832c003dddad26981947968e050ee1b152641c0ec5183a2a52a57078d0cd90e65a04134443ff96c6900369114d62823dc2eb44086a642162edac15bf79e1085
SSDEEP 49152:lteLKukUy/Y0KH0MJUCyReWZW3RUrYwCgX9TJ4LMPo5E+Yg2gWoX9mIUsChcvSqW:reyMveWiX9TSE1sm1G5JI
TLSH
T18E463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-08-01_3f45fbf2a1d4b3abd661714e9885b155_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 e2c4bdcb20b9a93913375f6a603797c46dfb2b46305d5b683b94dacbccd68c86
- MD5 3f45fbf2a1d4b3abd661714e9885b155
- SHA1 3453b8fbcea99ad256e37271b9cf5e7f81f3d8e6
- SHA512 4832c003dddad26981947968e050ee1b152641c0ec5183a2a52a57078d0cd90e65a04134443ff96c6900369114d62823dc2eb44086a642162edac15bf79e1085
- SSDEEP 49152:lteLKukUy/Y0KH0MJUCyReWZW3RUrYwCgX9TJ4LMPo5E+Yg2gWoX9mIUsChcvSqW:reyMveWiX9TSE1sm1G5JI
- TLSH
  T18E463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm defense_evasion discovery stealer
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Checks SCSI settings
  Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
behavioral1