d8a9fc4d0aac2e9ab713ec624564704b1751b6b96a7408e8de548f9f9c806e95

General

Target
2026-09-01_4c3dcd89cd541559ba7128aa22dd6d0f_dosia_glassworm_poet-rat_qnapcrypt
Size 5.4MB
Sample260903-ppewmss1by
SHA256 d8a9fc4d0aac2e9ab713ec624564704b1751b6b96a7408e8de548f9f9c806e95
MD5 4c3dcd89cd541559ba7128aa22dd6d0f
SHA1 77b8cb85c8ad938ea0ac4fa1a7ed7a451bff2cd8
SHA512 ce3a49496afcdd95bfb6d1681de7abb48ebeb2b956f33bfef529c1777406bd24e1e97bdd8bf49cdb22e3e9545819fe074ed77b2cd377b6a75864c19e1c70d879
SSDEEP 49152:5teLKOkt8YQE3HoMJRSyw+WNo+y0rY6CgX9jBdGM3o5E+Y92gWoX9mIUsChcvSqk:/eHMHSoSX9j4EGsm1G5J+
TLSH
T190463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-09-01_4c3dcd89cd541559ba7128aa22dd6d0f_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 d8a9fc4d0aac2e9ab713ec624564704b1751b6b96a7408e8de548f9f9c806e95
- MD5 4c3dcd89cd541559ba7128aa22dd6d0f
- SHA1 77b8cb85c8ad938ea0ac4fa1a7ed7a451bff2cd8
- SHA512 ce3a49496afcdd95bfb6d1681de7abb48ebeb2b956f33bfef529c1777406bd24e1e97bdd8bf49cdb22e3e9545819fe074ed77b2cd377b6a75864c19e1c70d879
- SSDEEP 49152:5teLKOkt8YQE3HoMJRSyw+WNo+y0rY6CgX9jBdGM3o5E+Y92gWoX9mIUsChcvSqk:/eHMHSoSX9j4EGsm1G5J+
- TLSH
  T190463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm defense_evasion discovery stealer
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Checks SCSI settings
  Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
behavioral1