gravityrat | 2ce327efe4f83b47227cf76fd9101027d745a08deed224ce16f09712cd28a82d

User tags

Assigned on submission by the user, not by sandbox detections.

experiment:claude-opus-4.6-repeat-pilot profile:5bc3155e4da2b85364b79a5e plan:194890df7f0746b554490773 mode:original repeat:1 sha256:2ce327efe4f83b47227cf76fd9101027d745a08deed224ce16f09712cd28a82d

Sharing

Copy URL Twitter E-mail

General

Target
2026-01-16_592693cd1f8e5be6f910d875184fdd72_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Size 10.1MB
Sample260821-b79l3sen4t
SHA256 2ce327efe4f83b47227cf76fd9101027d745a08deed224ce16f09712cd28a82d
MD5 592693cd1f8e5be6f910d875184fdd72
SHA1 bbad272766093e2131e9006cd8d34cf470d40370
SHA512 2b9314467e68f7941b9ee71202fe457e2b4f8c7cf513b596374ad0760056fa70157c7983f94e64fe15eff8a638609570a1754dde01374ebfe7a3916181a96f15
SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hREhRKhRrhRh:DAkLRLRxRYReR9Rh
TLSH
T11CB6BF32F9E505EAC2BFE274C06252217EB17C675331FB875F8055AA1D63BD0A92E312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gravityrat

https://ent34ndx3cz8k.x.pipedream.net
.b17da333ec194ec4b767.d.requestbin.net

Targets

- Target
  2026-01-16_592693cd1f8e5be6f910d875184fdd72_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 10.1MB
- SHA256 2ce327efe4f83b47227cf76fd9101027d745a08deed224ce16f09712cd28a82d
- MD5 592693cd1f8e5be6f910d875184fdd72
- SHA1 bbad272766093e2131e9006cd8d34cf470d40370
- SHA512 2b9314467e68f7941b9ee71202fe457e2b4f8c7cf513b596374ad0760056fa70157c7983f94e64fe15eff8a638609570a1754dde01374ebfe7a3916181a96f15
- SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hREhRKhRrhRh:DAkLRLRxRYReR9Rh
- TLSH
  T11CB6BF32F9E505EAC2BFE274C06252217EB17C675331FB875F8055AA1D63BD0A92E312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor gravityrat persistence
- Family: GravityRAT
  GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.
  backdoor gravityrat
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1