43bfff12d63ec5a1d56b67a430bba3d8e975ce6098408f8b3d66f99a03fd027d

General

Target
2026-08-07_3a25601beb030832c78e8b0f1db4059f_dosia_glassworm_poet-rat_qnapcrypt
Size 5.4MB
Sample260807-trtvssgr3z
SHA256 43bfff12d63ec5a1d56b67a430bba3d8e975ce6098408f8b3d66f99a03fd027d
MD5 3a25601beb030832c78e8b0f1db4059f
SHA1 bc3d62829df6c95c839730006c0fe9c2229ae5bb
SHA512 2bbd9118b9143ccb1d9756b85bcbc4e5e6039bf7596e5f311d28e5eec5c96d6e2c947a627bdd81bb380de44a97f7888be574b3d7d23d76faee9c75f7297e515a
SSDEEP 49152:fteLKukUy/Y0KH0MJUCyReWZW3RUrYwCgX9TJ4LMPo5E+YE2gWoX9mIUsChcvSqo:FeyMveWiX9TSEBsm1G5J+
TLSH
T17A463A53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-08-07_3a25601beb030832c78e8b0f1db4059f_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 43bfff12d63ec5a1d56b67a430bba3d8e975ce6098408f8b3d66f99a03fd027d
- MD5 3a25601beb030832c78e8b0f1db4059f
- SHA1 bc3d62829df6c95c839730006c0fe9c2229ae5bb
- SHA512 2bbd9118b9143ccb1d9756b85bcbc4e5e6039bf7596e5f311d28e5eec5c96d6e2c947a627bdd81bb380de44a97f7888be574b3d7d23d76faee9c75f7297e515a
- SSDEEP 49152:fteLKukUy/Y0KH0MJUCyReWZW3RUrYwCgX9TJ4LMPo5E+YE2gWoX9mIUsChcvSqo:FeyMveWiX9TSEBsm1G5J+
- TLSH
  T17A463A53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm defense_evasion discovery stealer
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Checks SCSI settings
  Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
behavioral1