Benign Download

2026-09-16_b0840e0e9c3b2a199a3c5adeafd4c26c_coinminer_glassworm_poet-rat_sliver_snatch

Detects GravityRATDetects executables referencing virtualization MAC addresses

SHA-256688788b90f7ee630da3d20e9d82bb3b7c530529db6bdd1a124f5dd9b0cd00036

URLhttps://tria.ge/api/v0/samples/260917-czt24avzfw/sample

MaleculeMdTh

Evidence

Embedded PE binary at file offset 0x2ca606 (~660549 bytes) 0x2ca5c6–0x2ca696

⋯3 more rows
0x2ca5f603e9bc8503e9bc8f03e9bc9603e9bcbb................
0x2ca6065456715141414d414141414541414141TVqQAAMAAAAEAAAA
0x2ca6162f2f3841414c67414141414141414141//8AALgAAAAAAAAA
0x2ca62651414141414141414141414141414141QAAAAAAAAAAAAAAA
⋯7 more rows

Encoded content decoded: base64 0x2f6ace–0x2f6b9e

⋯3 more rows
0x2f6afe565842736232466b5a57514163325630VXBsb2FkZWQAc2V0
0x2f6b0e5831527664474673526d6c735a584e56X1RvdGFsRmlsZXNV
0x2f6b1e634778765957526c5a41424a63306c75cGxvYWRlZABJc0lu
0x2f6b2e593278315a47566b41456c7a5258686aY2x1ZGVkAElzRXhj
⋯7 more rows

Encoded content decoded: hex → base64 0x5677c0–0x567890

⋯3 more rows
0x5677f000000000000000000000000000000000................
0x567800363636363636363636363636363636366666666666666666
0x567810363636363636363636363636363636366666666666666666
0x567820363636363636363636363636363636366666666666666666
⋯7 more rows

Detects GravityRAT 0x5c8bf7–0x5c8d77

⋯7 more rows
0x5c8c67324335320041657331393200524332002C52.Aes192.RC2.
0x5c8c77446574656374564d32004445434f4445DetectVM2.DECODE
0x5c8c875f53544f5245445f4c454e32004f5332_STORED_LEN2.OS2
⋯15 more rows

Detects executables referencing virtualization MAC addresses 0x5d02b6–0x5d0496

⋯3 more rows
0x5d02e6700070006f007200740065006400002fp.p.o.r.t.e.d../
0x5d02f6300030003a00350030003a00350036000.0.:.5.0.:.5.6.
0x5d030620002f00200056004d00770061007200 ./. .V.M.w.a.r.
0x5d031665002c00200049006e0063002e00002fe.,. .I.n.c..../
0x5d0326300030003a00300043003a00320039000.0.:.0.C.:.2.9.
0x5d033620002f00200056004d00770061007200 ./. .V.M.w.a.r.
0x5d034665002c00200049006e0063002e00002fe.,. .I.n.c..../
0x5d0356300030003a00300035003a00360039000.0.:.0.5.:.6.9.
0x5d036620002f00200056004d00770061007200 ./. .V.M.w.a.r.
0x5d037665002c00200049006e0063002e00005de.,. .I.n.c....]
0x5d0386300038003a00300030003a00320037000.8.:.0.0.:.2.7.
0x5d039620002f00200050004300530020005300 ./. .P.C.S. .S.
0x5d03a679007300740065006d00740065006300y.s.t.e.m.t.e.c.
0x5d03b668006e0069006b00200047006d006200h.n.i.k. .G.m.b.
0x5d03c648002000280056006900720074007500H. .(.V.i.r.t.u.
0x5d03d661006c0042006f007800290000353000a.l.B.o.x.)..50.
0x5d03e630003a00310043003a003400320020000.:.1.C.:.4.2. .
0x5d03f62f00200050006100720061006c006c00/. .P.a.r.a.l.l.
0x5d040665006c0073002c00200049006e006300e.l.s.,. .I.n.c.
0x5d04162e000035300030003a00310036003a00...50.0.:.1.6.:.
0x5d04263300450020002f002000580065006e003.E. ./. .X.e.n.
⋯7 more rows