68afbdfd1f01f85d745f38550aa66570c699310bd4b929c0a05a1034d21528d8

General

Target
2026-08-01_0f1550086c1c541d1f451ea3c3fbad91_dosia_glassworm_poet-rat_qnapcrypt
Size 5.4MB
Sample260802-bqeqdabc82
SHA256 68afbdfd1f01f85d745f38550aa66570c699310bd4b929c0a05a1034d21528d8
MD5 0f1550086c1c541d1f451ea3c3fbad91
SHA1 3ba38fd728531cb251026fe05fc443ff17b9d445
SHA512 ec31544dc445d0441dacd7832056eb5bb9bd51d3cfbd786c88db2ac905a4db25daf17c2e434921afe4ba64f4bdf0b4c656233463f43dca6724d03983d69eab90
SSDEEP 49152:uteLKOkt8YQE3HoMJRSyw+WNo+y0rY6CgX9jBdGM3o5E+Yr2gWoX9mIUsChcvSq/:ieHMHSoSX9j4Egsm1G5J9
TLSH
T197463A53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-08-01_0f1550086c1c541d1f451ea3c3fbad91_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 68afbdfd1f01f85d745f38550aa66570c699310bd4b929c0a05a1034d21528d8
- MD5 0f1550086c1c541d1f451ea3c3fbad91
- SHA1 3ba38fd728531cb251026fe05fc443ff17b9d445
- SHA512 ec31544dc445d0441dacd7832056eb5bb9bd51d3cfbd786c88db2ac905a4db25daf17c2e434921afe4ba64f4bdf0b4c656233463f43dca6724d03983d69eab90
- SSDEEP 49152:uteLKOkt8YQE3HoMJRSyw+WNo+y0rY6CgX9jBdGM3o5E+Yr2gWoX9mIUsChcvSq/:ieHMHSoSX9j4Egsm1G5J9
- TLSH
  T197463A53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm defense_evasion discovery stealer
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Checks SCSI settings
  Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
behavioral1