poseidon | 2026-10-22_7945967abaf6b5977b40f75bf34d631c_ddos-tf_dosia_glassworm_poet-rat_qnapcrypt

General

Target
2026-10-22_7945967abaf6b5977b40f75bf34d631c_ddos-tf_dosia_glassworm_poet-rat_qnapcrypt
Size 7.5MB
Sample261024-jqv2csav8k
SHA256 1cfee868e5e488bb862140cf288fce46a167aa5982900102356dac552fa4fa43
MD5 7945967abaf6b5977b40f75bf34d631c
SHA1 8fbdc86bb9a00a7a90ae2c10beead7461f7ccfb6
SHA512 db0b19d9d2baffbb098115b4729b551ed67e3896abd57f51b420bd67fe407fd6f7ea80b02728b7910fc3f1c3aec535c8d88e1b917035f6348257549cebc94a7a
SSDEEP 98304:UXShqR9n5AJbrS7eY34XFfX/mXGUfcX0kXSlkRQAlTnE:Uv9nL7L341fP7OCpTE
TLSH
T1F4864A03ECA655E9C1AAD1308A639263BB717C485B3027E72B60F7342F77BD06A79750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: Poseidon
Poseidon is a two-stage ELF downloader that establishes persistence and fetches a backdoor written in Golang.
loader backdoor poseidon

Detected Poseidon Payload 1 IoCs

resource	yara_rule
sample	family_poseidon

2026-10-22_7945967abaf6b5977b40f75bf34d631c_ddos-tf_dosia_glassworm_poet-rat_qnapcrypt

.elf 7.5MB

SHA256 1cfee868e5e488bb862140cf288fce46a167aa5982900102356dac552fa4fa43
MD5 7945967abaf6b5977b40f75bf34d631c
SHA1 8fbdc86bb9a00a7a90ae2c10beead7461f7ccfb6
SHA512 db0b19d9d2baffbb098115b4729b551ed67e3896abd57f51b420bd67fe407fd6f7ea80b02728b7910fc3f1c3aec535c8d88e1b917035f6348257549cebc94a7a
SSDEEP 98304:UXShqR9n5AJbrS7eY34XFfX/mXGUfcX0kXSlkRQAlTnE:Uv9nL7L341fP7OCpTE
TLSH
T1F4864A03ECA655E9C1AAD1308A639263BB717C485B3027E72B60F7342F77BD06A79750
MD5 SHA1 SHA512 SSDEEP TLSH

linux x64