Extracted

• • Target
    2026-07-18_d143203bac52c06f3cc739c143876f33_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 10.6MB
  • SHA256 89896ed0676cee6a5fce9cd70596f1151b7ccf1de359b4004aa1f3dcf608e324
  • MD5 d143203bac52c06f3cc739c143876f33
  • SHA1 2bf8db6a7066a6904e0d7db13e75d2715b2ac351
  • SHA512 0597a5e777063addb082f7c22398fca3e890b283a7c6da294564e3087c0a71a3e06671addd9225ba8c3efcdf21b90c3a23946056196764f201aa9156552d3745
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hREhRNhRdhR3hR8:DAkLRLRxRYRfRvRxR8
  • TLSH
    T165B6BF32F6E405EAC2BFE274C06252217EB178675326FB875F8055E91D63BD0AD2E312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2