General
- Target 2026-11-07_194008f21bc2b8f49a23cffa9a9697d9_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- Sample261107-tzpwtazvdw
- SHA256 c81edf8b6f9d6691f29a3ba56f4be2a7b6aa661c93a4913e8e5d7085fc81e7b9
Score
10/10
Malware Config
Targets
-
- Target 2026-11-07_194008f21bc2b8f49a23cffa9a9697d9_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 c81edf8b6f9d6691f29a3ba56f4be2a7b6aa661c93a4913e8e5d7085fc81e7b9
Score10/10Detects GoDDoSAgent
Family: GoDDoSAgent
GoDDoSAgent is a Linux botnet written in GoLang.
Creates/modifies environment variables
Creating/modifying environment variables is a common persistence mechanism.
Write file to user bin folder
Modifies Bash startup script
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Privilege Escalation
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1