Overview

overview

10

Static

static

10

2026-06-30..._p.exe

windows10-2004-x64

10

Resubmissions

31/07/2026, 16:04

260731-th324sda9610

01/07/2026, 00:05

260701-adhe3aaw8l10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-06-30_24d07cb33d4d2f61ed8bea0a99cf2997_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
  • Size 6.1MB
  • Sample260731-th324sda96
  • SHA256 2fe0e5570713052870a347029f26326126c54d51acbd7a7172e56b198133f372
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
moonriseexecutionpersistencerat

Malware Config

Extracted

Family

  • moonrise

C2

  • ws://31.76.241.232:8765

Targets

    • Target
      2026-06-30_24d07cb33d4d2f61ed8bea0a99cf2997_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
    • Size 6.1MB
    • SHA256 2fe0e5570713052870a347029f26326126c54d51acbd7a7172e56b198133f372
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    executionmoonrisepersistencerat

    • Detects MoonriseRAT aka GrobRAT

    • Family: Moonrise, GrobRAT

      Moonrise aka GrobRAT is a Windows RAT written in Golang.

      ratmoonrise

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks