4e7b14946c25942c77ee5edbd8a6d0104956a8214e27e72ef247126326fb69bf

General

Target
2026-08-24_a6bee1ae2741fa8c6d8ebc71d861cd62_dosia_glassworm_poet-rat_qnapcrypt
Size 5.4MB
Sample260825-ftz8psxand
SHA256 4e7b14946c25942c77ee5edbd8a6d0104956a8214e27e72ef247126326fb69bf
MD5 a6bee1ae2741fa8c6d8ebc71d861cd62
SHA1 d60d8d7e4a0789c6d186eff28622153f7f90567d
SHA512 4378564f6db5ad72657a5f2334b86fcfacdd90138508d0a2a9148178539d864d6b45d08f8c0c40b0ca514d918e442d2a5a9db8a4d2bbca9852f2f75f44cb54eb
SSDEEP 49152:MteLKukUy/Y0KH0MJUCyReWZW3RUrYwCgX9TJ4LMPo5E+Y02gWoX9mIUsChcvSqt:4eyMveWiX9TSERsm1G5J3
TLSH
T116463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-08-24_a6bee1ae2741fa8c6d8ebc71d861cd62_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 4e7b14946c25942c77ee5edbd8a6d0104956a8214e27e72ef247126326fb69bf
- MD5 a6bee1ae2741fa8c6d8ebc71d861cd62
- SHA1 d60d8d7e4a0789c6d186eff28622153f7f90567d
- SHA512 4378564f6db5ad72657a5f2334b86fcfacdd90138508d0a2a9148178539d864d6b45d08f8c0c40b0ca514d918e442d2a5a9db8a4d2bbca9852f2f75f44cb54eb
- SSDEEP 49152:MteLKukUy/Y0KH0MJUCyReWZW3RUrYwCgX9TJ4LMPo5E+Y02gWoX9mIUsChcvSqt:4eyMveWiX9TSERsm1G5J3
- TLSH
  T116463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm defense_evasion discovery stealer
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Checks SCSI settings
  Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
behavioral1