b62db7e135e308e31012e3f81fdaaf64ec33d4827ed43fff8ee166c05e962993

General

Target
2026-08-03_0694ae6945c8b0475e4487dbd58fe4f9_dosia_glassworm_poet-rat_qnapcrypt
Size 5.4MB
Sample260804-d4jbtsvvdx
SHA256 b62db7e135e308e31012e3f81fdaaf64ec33d4827ed43fff8ee166c05e962993
MD5 0694ae6945c8b0475e4487dbd58fe4f9
SHA1 54eada019a5de0852be26d3bb0e70ef9b3380c11
SHA512 312999e682ebc79499b602d482387875cba2555d1ae37e92b40b5f6633a6a8dcb9ece0fd92a1ddc9bf5bcc64f8e30eaa07f2b5c7e150a67c564d75270ca2206d
SSDEEP 49152:BteLKukUy/Y0KH0MJUCyReWZW3RUrYwCgX9TJ4LMPo5E+Ya2gWoX9mIUsChcvSqY:HeyMveWiX9TSELsm1G5Ju
TLSH
T129463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-08-03_0694ae6945c8b0475e4487dbd58fe4f9_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 b62db7e135e308e31012e3f81fdaaf64ec33d4827ed43fff8ee166c05e962993
- MD5 0694ae6945c8b0475e4487dbd58fe4f9
- SHA1 54eada019a5de0852be26d3bb0e70ef9b3380c11
- SHA512 312999e682ebc79499b602d482387875cba2555d1ae37e92b40b5f6633a6a8dcb9ece0fd92a1ddc9bf5bcc64f8e30eaa07f2b5c7e150a67c564d75270ca2206d
- SSDEEP 49152:BteLKukUy/Y0KH0MJUCyReWZW3RUrYwCgX9TJ4LMPo5E+Ya2gWoX9mIUsChcvSqY:HeyMveWiX9TSELsm1G5Ju
- TLSH
  T129463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm defense_evasion discovery stealer
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Checks SCSI settings
  Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
behavioral1