Extracted

• • Target
    2026-08-06_04ff38bd5849307d0eaecc5ba659b58f_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 11.4MB
  • SHA256 2f8044ad5f661e9bacaa9ccd95e4131728806e20ab4f571b24d3b77e9796c3b9
  • MD5 04ff38bd5849307d0eaecc5ba659b58f
  • SHA1 85d49ea2ebee832cb57638deb7c9ed1f8911687a
  • SHA512 fc5c14f7d3a6b47a64a2e1d30f62d6f59b02e5de2dc0ddb63f7989c9944046e897254f7249b78b7c627b382ffd8b5aabe4684710c2b58a94f4fa659b6d8c24c1
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hRbhRahRthRGhRjhRI:DAkLRLRxRtRuR/RyRFRI
  • TLSH
    T1B4C6B032F6E405EAC2BFE274C06246217EB1B8675326FB8B5F8055E91D63BD0A91D313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2