74515e41af5a016e692cd742b68158d7fbeaccdf26c989915e5356422c77eccf

General

Target
2026-08-01_1b60009a4cdd5fecebd6e37bd8dbeb94_dosia_glassworm_poet-rat_qnapcrypt
Size 5.4MB
Sample260802-blhw8s1thz
SHA256 74515e41af5a016e692cd742b68158d7fbeaccdf26c989915e5356422c77eccf
MD5 1b60009a4cdd5fecebd6e37bd8dbeb94
SHA1 9ace7261b9a48dbd0d2239fd5e6ba9bd09821827
SHA512 a12519164d1c69f500860e933c05078ec261da28e9d28a1572de72d6440b850d69a9f7a22b2f78bb18b8d418910b1b28bc8a32d3f8c0c3b63a0774a14f734b68
SSDEEP 49152:yteLKOkt8YQE3HoMJRSyw+WNo+y0rY6CgX9jBdGM3o5E+Yt2gWoX9mIUsChcvSqF:WeHMHSoSX9j4E+sm1G5JP
TLSH
T19A463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-08-01_1b60009a4cdd5fecebd6e37bd8dbeb94_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 74515e41af5a016e692cd742b68158d7fbeaccdf26c989915e5356422c77eccf
- MD5 1b60009a4cdd5fecebd6e37bd8dbeb94
- SHA1 9ace7261b9a48dbd0d2239fd5e6ba9bd09821827
- SHA512 a12519164d1c69f500860e933c05078ec261da28e9d28a1572de72d6440b850d69a9f7a22b2f78bb18b8d418910b1b28bc8a32d3f8c0c3b63a0774a14f734b68
- SSDEEP 49152:yteLKOkt8YQE3HoMJRSyw+WNo+y0rY6CgX9jBdGM3o5E+Yt2gWoX9mIUsChcvSqF:WeHMHSoSX9j4E+sm1G5JP
- TLSH
  T19A463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm defense_evasion discovery stealer
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Checks SCSI settings
  Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
behavioral1