Extracted

• • Target
    2026-07-30_833010dc71e456d5af825fc8c6ca3118_cobalt-strike_coinminer_glassworm_poet-rat
  • Size 11.3MB
  • SHA256 1af93738aef5cc1bc6f1977e64fb6533f4db992719990210e534ba7da1642d74
  • MD5 833010dc71e456d5af825fc8c6ca3118
  • SHA1 e52820cd72981bd04e7f40706f9ee057accf8624
  • SHA512 ec1bbad853fb4f3f511dcdd4de180bd8f34fd25eea240aa98f0ffb0c2c1bf1a8cb74853b4cd20ba24c8e5e04458d742178be77bc1992adadad900d69b890e53e
  • SSDEEP 196608:VmD5q1SGs2y7QNTpWLhR4hRmhRihRMhRchR2hR0hRc:4A+FRERSRGRwRARiRIRc
  • TLSH
    T116C6B032B6E405AAC6FFE274C05242217EB178675336FB8B5F8055EA1D63BD0AD2D312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityrat

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2