afb1baaf95c38690a7ca9f668a7bd1548ff2ec4b8e7706278948cbf4239243b8

General

Target
2026-10-16_e45e5e38ecea519e0feefd4903c62213_dosia_glassworm_poet-rat_qnapcrypt
Size 5.4MB
Sample261017-e4g97swzby
SHA256 afb1baaf95c38690a7ca9f668a7bd1548ff2ec4b8e7706278948cbf4239243b8
MD5 e45e5e38ecea519e0feefd4903c62213
SHA1 010bd2dfa480d66b8e3a307fefdd570d743e8304
SHA512 572c31fb23d506be9ace5d49e6e2da750ae426d6d9de10bf3d3320a5c56cccbf8c31ebe8e1e59c9a6b92b8771b1ab7a232b4d02ca92daf57c4c8a63223ff2cfc
SSDEEP 49152:ateLKOkt8YQE3HoMJRSyw+WNo+y0rY6CgX9jBdGM3o5E+Yn2gWoX9mIUsChcvSq/:+eHMHSoSX9j4Essm1G5JB
TLSH
T154463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-10-16_e45e5e38ecea519e0feefd4903c62213_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 afb1baaf95c38690a7ca9f668a7bd1548ff2ec4b8e7706278948cbf4239243b8
- MD5 e45e5e38ecea519e0feefd4903c62213
- SHA1 010bd2dfa480d66b8e3a307fefdd570d743e8304
- SHA512 572c31fb23d506be9ace5d49e6e2da750ae426d6d9de10bf3d3320a5c56cccbf8c31ebe8e1e59c9a6b92b8771b1ab7a232b4d02ca92daf57c4c8a63223ff2cfc
- SSDEEP 49152:ateLKOkt8YQE3HoMJRSyw+WNo+y0rY6CgX9jBdGM3o5E+Yn2gWoX9mIUsChcvSq/:+eHMHSoSX9j4Essm1G5JB
- TLSH
  T154463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm defense_evasion discovery stealer
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Checks SCSI settings
  Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
behavioral1