Extracted

• • Target
    2026-08-20_9b20bedcc08a810997b767415f224bb3_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 11.3MB
  • SHA256 88a51a51ea03b9d03502f44b33f1f32b24d7d2245d7038f86b50efb0eee25f8d
  • MD5 9b20bedcc08a810997b767415f224bb3
  • SHA1 b792b6286e5683c8ecf246dfc73910db5f43ccfd
  • SHA512 1e45d5f61339c7491d23e24f388c23dd1ad606f1837a01078ef6cdfbeead1aec140b03fc7ed67d6c140a67b243e5ddbb9773a043b1884f7d683c5bf02e314e2f
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hRbhRmhRBhRbhREhRk:DAkLRLRxRtRSRLRtRYRk
  • TLSH
    T12BC6BF32F6E405EAC2BFE274C06246217EB178675326FB8B5F8055E91D63BD0A91E313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2