b3c263cce9897b9e8e0be7d7fa77c2cb8fbe1106291ece21ca10935d78b8e9c8

General

Target
2026-11-10_d8b2715527d82878e7ffd80ee4b1953f_dosia_glassworm_poet-rat_qnapcrypt
Size 5.4MB
Sample261110-fs3mfada93
SHA256 b3c263cce9897b9e8e0be7d7fa77c2cb8fbe1106291ece21ca10935d78b8e9c8
MD5 d8b2715527d82878e7ffd80ee4b1953f
SHA1 0f799b2747c502c9bece749cff52ed0f2ee88133
SHA512 b02f59d4317ff718a8173471d69126d1c244c724c62ba3f7db55b7638afc6267489cb62494a3fa24930ba5e764e8fd9fbc012decd3416cc062fbb4397b18c21a
SSDEEP 49152:ateLKukUy/Y0KH0MJUCyReWZW3RUrYwCgX9TJ4LMPo5E+YK2gWoX9mIUsChcvSq5:+eyMveWiX9TSELsm1G5JT
TLSH
T1DF463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  2026-11-10_d8b2715527d82878e7ffd80ee4b1953f_dosia_glassworm_poet-rat_qnapcrypt
- Size 5.4MB
- SHA256 b3c263cce9897b9e8e0be7d7fa77c2cb8fbe1106291ece21ca10935d78b8e9c8
- MD5 d8b2715527d82878e7ffd80ee4b1953f
- SHA1 0f799b2747c502c9bece749cff52ed0f2ee88133
- SHA512 b02f59d4317ff718a8173471d69126d1c244c724c62ba3f7db55b7638afc6267489cb62494a3fa24930ba5e764e8fd9fbc012decd3416cc062fbb4397b18c21a
- SSDEEP 49152:ateLKukUy/Y0KH0MJUCyReWZW3RUrYwCgX9TJ4LMPo5E+YK2gWoX9mIUsChcvSq5:+eyMveWiX9TSELsm1G5JT
- TLSH
  T1DF463B53FCA545E4C0AED630C6629263BA71BC495B3023D33B60F7692F76BD0AA79740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

antivm defense_evasion discovery stealer
- Reads EFI boot settings
  Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.
  stealer
- Checks SCSI settings
  Checks list of SCSI devices which may be used to detect VMware or VirtualBox.
  antivm
- Checks hardware identifiers (DMI)
  Checks DMI information which indicate if the system is a virtual machine.
  antivm
- Checks mountinfo of local process
  Checks mountinfo of running processes which indicate if it is running in chroot jail.
  antivm
- Enumerates running processes
  Discovers information about currently running processes on the system
- Reads hardware information
  Accesses system info like serial numbers, manufacturer names etc.
  discovery
- Reads list of loaded kernel modules
  Reads the list of currently loaded kernel modules, possibly to detect virtual environments.
  defense_evasion
behavioral1