Extracted

• • Target
    2026-08-05_38c496a04534b313778e9ece87c3dc47_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 12.0MB
  • SHA256 c512dd02f4edb4d48d1c803fad63b9ac7d10d4b9179b92b429338f297774310d
  • MD5 38c496a04534b313778e9ece87c3dc47
  • SHA1 ad66de4ae6f26a33bb11a6a04806420b09f0fba1
  • SHA512 465e27566f36f7887d3c2a5c87df11f3e0b06dc810e547162d770b1edfd2d7e00dfba4db761496f23013c657e21f9ae0034900378f4aa19676186514a661d152
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hREhRNhRdhR3hRShR4hRF:DAkLRLRxRYRfRvRxR2RERF
  • TLSH
    T11CC6B032B6E445EAC2BFE274C06206217EB1B8675326FB8B5F8055ED1D63BD0AD19313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2