Extracted

• • Target
    2026-07-18_b3a26b8a9356ee5867332cd76081e55c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 10.5MB
  • SHA256 06a464ad44b3c15bf08073c7f16c53c4680c66d211c6fb4c72348d06639ea246
  • MD5 b3a26b8a9356ee5867332cd76081e55c
  • SHA1 1ab35bd20c92843dfb7010dc6b7b9d2373765f48
  • SHA512 44084d34f3107df226d5f74eca3f09b7a1488d05181f7502febb1e712218f43d0d0c5e7f29d7d31f4dffb743afbd53210a81d259d686793d9407b38e15a76698
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hREhRNhRdhR3hRp:DAkLRLRxRYRfRvRxRp
  • TLSH
    T10CB6BF32F6E405EAC2BFE274C06246217EB178675326FB875F8055E91D63BD0AD2E312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat
  • Custom signature

    Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2