Extracted

• • Target
    2026-08-08_c5a058af7b48ab21dfc8379aebf8d77a_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 12.4MB
  • SHA256 836a8f232737b5af71edd41ecfede330e1ee4df198b27b69ac7553f257c38913
  • MD5 c5a058af7b48ab21dfc8379aebf8d77a
  • SHA1 93e53aab5d7c215437c75de2c71d2c89356ef3ad
  • SHA512 41c5e567b239036d0c9e514a9bc0b49c829c8dffe8c4e57b360df8ff15f02199041631456e1e7e49f3d64c10af0b21fddd1e4e42e870f647313f3d8cfa69df14
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhRhhRQhRkhRAhRMhRyhRjhRWhR5:DAkLRLRrRMR4R8RwRWRFRCR5
  • TLSH
    T125D6B032B6E445AAC2BFE274C06206217FB1B8675326FB8B5F8055ED1D63BD0AD19313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2