bc602dfaf9d29e444eb64f3479fe74ec9e43fe982d0799a574270f035a76701e

General

Target
2026-11-07_629071885db107212f8dd73148a50c88_dosia_glassworm_poet-rat_qnapcrypt
Size 5.4MB
Sample261107-qwsazsys9r
SHA256 bc602dfaf9d29e444eb64f3479fe74ec9e43fe982d0799a574270f035a76701e
MD5 629071885db107212f8dd73148a50c88
SHA1 82af76d241e7782efccb38a7850d461d94e95c4a
SHA512 93e2b5f923cb089c05694599bf62e8fc0b67ff4ec37085a53b6fbe8cfffb05a4d74bbeb3dc3949098aa452a1d57e29f196c00d90337cb7c88445c3283bdfa67b
SSDEEP 49152:5teLKOkt8YQE3HoMJRSyw+WNo+y0rY6CgX9jBdGM3o5E+Y72gWoX9mIUsChcvSqy:/eHMHSoSX9j4EIsm1G5J0
TLSH
T137463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-11-07_629071885db107212f8dd73148a50c88_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 bc602dfaf9d29e444eb64f3479fe74ec9e43fe982d0799a574270f035a76701e
- MD5 629071885db107212f8dd73148a50c88
- SHA1 82af76d241e7782efccb38a7850d461d94e95c4a
- SHA512 93e2b5f923cb089c05694599bf62e8fc0b67ff4ec37085a53b6fbe8cfffb05a4d74bbeb3dc3949098aa452a1d57e29f196c00d90337cb7c88445c3283bdfa67b
- SSDEEP 49152:5teLKOkt8YQE3HoMJRSyw+WNo+y0rY6CgX9jBdGM3o5E+Y72gWoX9mIUsChcvSqy:/eHMHSoSX9j4EIsm1G5J0
- TLSH
  T137463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm defense_evasion discovery stealer
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Checks SCSI settings
  Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
behavioral1