Extracted

• • Target
    2026-07-10_bc3f9adf74c6f403b37442a3f5249fa2_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 11.4MB
  • SHA256 1200ea8c85f9e4ccbfe34601171d756affcf577bc3ed888434ce71cbcf3c9b02
  • MD5 bc3f9adf74c6f403b37442a3f5249fa2
  • SHA1 2f3659fe49cf9fa2858001996f7514b882f017b1
  • SHA512 2722a7fd5ba83462f9f003090201c975e67a5292ce5ca591062564252959a6cd7bdb6b69d89eaa3b52be5ae21575942d718e101071540f229df040f32a9c1fee
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hREhRNhRdhR3hRChRG:DAkLRLRxRYRfRvRxRmRG
  • TLSH
    T181C6B032F6E405EAC2BFE274C06216217EB178675326FB8B5F8055E91D63BD0A91E313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2