832023b1bdcd0183e734824e30c6efac1ccbb3a1c1b98a86c7e494fa9806e012

General

Target
2026-08-12_df716fa3f5a7c1adabead4fbe33ba76f_dosia_glassworm_poet-rat_qnapcrypt
Size 5.4MB
Sample260812-mrle4asshw
SHA256 832023b1bdcd0183e734824e30c6efac1ccbb3a1c1b98a86c7e494fa9806e012
MD5 df716fa3f5a7c1adabead4fbe33ba76f
SHA1 5b474e577992da3ff2aa16319072eb413ec4e638
SHA512 baf7731b8648c0929b7c96ca741d58fa8d0b1e66da55364a24689eb8055925e6ab5ccb4e83c628a8d3f4391e53295662c8be5997cd02444845fda99c3557b3f7
SSDEEP 49152:5teLKukUy/Y0KH0MJUCyReWZW3RUrYwCgX9TJ4LMPo5E+YK2gWoX9mIUsChcvSqg:/eyMveWiX9TSErsm1G5J2
TLSH
T15C463A53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-08-12_df716fa3f5a7c1adabead4fbe33ba76f_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 832023b1bdcd0183e734824e30c6efac1ccbb3a1c1b98a86c7e494fa9806e012
- MD5 df716fa3f5a7c1adabead4fbe33ba76f
- SHA1 5b474e577992da3ff2aa16319072eb413ec4e638
- SHA512 baf7731b8648c0929b7c96ca741d58fa8d0b1e66da55364a24689eb8055925e6ab5ccb4e83c628a8d3f4391e53295662c8be5997cd02444845fda99c3557b3f7
- SSDEEP 49152:5teLKukUy/Y0KH0MJUCyReWZW3RUrYwCgX9TJ4LMPo5E+YK2gWoX9mIUsChcvSqg:/eyMveWiX9TSErsm1G5J2
- TLSH
  T15C463A53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm defense_evasion discovery stealer
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Checks SCSI settings
  Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
behavioral1