gravityrat | 694941c3c73caec9917212faa730f644416076671fdeb6a3dd600a6a1c34607b

User tags

Assigned on submission by the user, not by sandbox detections.

experiment:claude-opus-4.6-repeat-pilot profile:5bc3155e4da2b85364b79a5e plan:194890df7f0746b554490773 mode:original repeat:2 sha256:694941c3c73caec9917212faa730f644416076671fdeb6a3dd600a6a1c34607b

Sharing

Copy URL Twitter E-mail

General

Target
2026-01-16_4b722fe9bbb1eb069cacab178711b823_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
Size 13.4MB
Sample260821-ref23afp2x
SHA256 694941c3c73caec9917212faa730f644416076671fdeb6a3dd600a6a1c34607b
MD5 4b722fe9bbb1eb069cacab178711b823
SHA1 f502afedbbe9c1c905a471ead602d4e176bfa7a0
SHA512 f60dd695356c675448639b06db8f92ec8d522c15d3d0994b7fb7769db52a1d702584bf553aa13a5d80b6957b8f2fd1216b8b6962538c022674d8aa907c4f750f
SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hRxhRehRthRrhRJhRchRQhROhRnhRS:DAkLRCR3R7R6R/R9RDRARMRqRhRS
TLSH
T1FFE6B032B6E445AAC2BFD274C06206227FB1B8675326FB8B5F8055ED1D63BD0AD19313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gravityrat

https://ent34ndx3cz8k.x.pipedream.net
.b17da333ec194ec4b767.d.requestbin.net

Targets

- Target
  2026-01-16_4b722fe9bbb1eb069cacab178711b823_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 13.4MB
- SHA256 694941c3c73caec9917212faa730f644416076671fdeb6a3dd600a6a1c34607b
- MD5 4b722fe9bbb1eb069cacab178711b823
- SHA1 f502afedbbe9c1c905a471ead602d4e176bfa7a0
- SHA512 f60dd695356c675448639b06db8f92ec8d522c15d3d0994b7fb7769db52a1d702584bf553aa13a5d80b6957b8f2fd1216b8b6962538c022674d8aa907c4f750f
- SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hRxhRehRthRrhRJhRchRQhROhRnhRS:DAkLRCR3R7R6R/R9RDRARMRqRhRS
- TLSH
  T1FFE6B032B6E445AAC2BFD274C06206227FB1B8675326FB8B5F8055ED1D63BD0AD19313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor gravityrat persistence
- Family: GravityRAT
  GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.
  backdoor gravityrat
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1