Extracted

• • Target
    2026-08-08_61e3f5182df1f9f843635343df5696c1_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 12.5MB
  • SHA256 0030eb85cf89bdc108f3d04a12b2b58ec0c6728830d584358539dc6cd4c564b2
  • MD5 61e3f5182df1f9f843635343df5696c1
  • SHA1 a83d23490ca2c8849ee79933ff2634ecd387a485
  • SHA512 a8c59da1cc5fb819dc3e396e8194d604eaef6fb0d5ea6136a924483136eebe286640478840b480ecdccbe7efcca18be719347ea157dfc33b597adc0cf8c2ddc6
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhRhhRQhRkhRAhRMhRyhRjhRWhRI:DAkLRLRrRMR4R8RwRWRFRCRI
  • TLSH
    T1DFD6B032B6E445EAC2BFE274C06206217EB1B8675326FB8B5F8055ED1D63BD0AD19313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2