poseidon | 2026-09-29_383def5192134e992773a2b8e369ec46_ddos-tf_dosia_glassworm_poet-rat_qnapcrypt

General

Target
2026-09-29_383def5192134e992773a2b8e369ec46_ddos-tf_dosia_glassworm_poet-rat_qnapcrypt
Size 8.2MB
Sample260930-12ft9azvfs
SHA256 87f91fed5346614a19b064852840f21e50ad7a245a93f765582ac5c3acf8b3a1
MD5 383def5192134e992773a2b8e369ec46
SHA1 5a4f831d4cb7555eb347dd67beff71a4a57d6209
SHA512 47fc009aef9f6e2b54e639b4c09907d34d67931178d0e96507e1c45d0d0c2a7baf95e8217ffac1b7b3bedcd2d1eba4ee17c4f6ef12c422f1218e2ea282f1f2bd
SSDEEP 98304:bYYooDwKRjIZ/UvltDsRgpWUKQc4ZTubpE:bDXjU/UTQR3D4um
TLSH
T1BB865A43ECA655E9C0AAD1308A669663BB717C485B3027D73F60F7342F76BD06A7A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: Poseidon
Poseidon is a two-stage ELF downloader that establishes persistence and fetches a backdoor written in Golang.
loader backdoor poseidon

Detected Poseidon Payload 1 IoCs

resource	yara_rule
sample	family_poseidon

2026-09-29_383def5192134e992773a2b8e369ec46_ddos-tf_dosia_glassworm_poet-rat_qnapcrypt

.elf 8.2MB

SHA256 87f91fed5346614a19b064852840f21e50ad7a245a93f765582ac5c3acf8b3a1
MD5 383def5192134e992773a2b8e369ec46
SHA1 5a4f831d4cb7555eb347dd67beff71a4a57d6209
SHA512 47fc009aef9f6e2b54e639b4c09907d34d67931178d0e96507e1c45d0d0c2a7baf95e8217ffac1b7b3bedcd2d1eba4ee17c4f6ef12c422f1218e2ea282f1f2bd
SSDEEP 98304:bYYooDwKRjIZ/UvltDsRgpWUKQc4ZTubpE:bDXjU/UTQR3D4um
TLSH
T1BB865A43ECA655E9C0AAD1308A669663BB717C485B3027D73F60F7342F76BD06A7A310
MD5 SHA1 SHA512 SSDEEP TLSH

linux x64