General
- Target 2026-08-05_5817be5858e3e4a5cfa49f69a1c6004b_dosia_glassworm_poet-rat_qnapcrypt
- Size 4.5MB
- Sample260806-amarkszaqe
- SHA256 e7f5644ab6c3fe20eb4d70cb35e99848480e99cd3ef9fe9275ef1cd68def15ae
- MD5 5817be5858e3e4a5cfa49f69a1c6004b
- SHA1 7b565a8cb7d76aa6d1861622d7cf7f623f6bdec4
- SHA512 a0f115b0d2dd3ff59fa1f7faf8ce701784bb6789c5b9fd646113ad733a17d295695d234bbdef1d939e81e71b5ac733438f5e56413eb35b5273e19d6a12d4d701
- SSDEEP 49152:LJ+ZArb/TdvO90dL3BmAFd4A64nsfJRxqkbvG6mpeggOhXv4uzWkxTg3FJ24pv18:FWrO68A8xiE/C
- TLSH T1A5263943F89191E5C1AED130C666D293BA717C895B3023D32F50BBB92B36BD4AE79314
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-05_5817be5858e3e4a5cfa49f69a1c6004b_dosia_glassworm_poet-rat_qnapcrypt
Resource
ubuntu1804-amd64-20260513-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-05_5817be5858e3e4a5cfa49f69a1c6004b_dosia_glassworm_poet-rat_qnapcrypt
- Size 4.5MB
- SHA256 e7f5644ab6c3fe20eb4d70cb35e99848480e99cd3ef9fe9275ef1cd68def15ae
- MD5 5817be5858e3e4a5cfa49f69a1c6004b
- SHA1 7b565a8cb7d76aa6d1861622d7cf7f623f6bdec4
- SHA512 a0f115b0d2dd3ff59fa1f7faf8ce701784bb6789c5b9fd646113ad733a17d295695d234bbdef1d939e81e71b5ac733438f5e56413eb35b5273e19d6a12d4d701
- SSDEEP 49152:LJ+ZArb/TdvO90dL3BmAFd4A64nsfJRxqkbvG6mpeggOhXv4uzWkxTg3FJ24pv18:FWrO68A8xiE/C
- TLSH T1A5263943F89191E5C1AED130C666D293BA717C895B3023D32F50BBB92B36BD4AE79314
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Creates/modifies Cron job
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
-
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
-
Write file to user bin folder
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Scheduled Task/Job
1Cron
1