Extracted

• • Target
    2026-08-22_b9cc773618a64ce0eed4a0068ffe19ba_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 13.4MB
  • SHA256 ca15d6e6336e9b0f479a584f74c901f4b8b6efbd3c1bc0214f18754ed9f4e14c
  • MD5 b9cc773618a64ce0eed4a0068ffe19ba
  • SHA1 ad7418937d4d6e8f8036720240020ee4e28f7abc
  • SHA512 ba59a1f3b9c3df24b7963576652f80176d0d9ff6905a6d037a635f9570aeaa80bb5bbcc8b17c8a4e407bddcb02dc40bfb49ce8a27b5faec2d749aeb381ce99d0
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hRxhRehahRChRVhREhR2hRZhRrhRA:DAkLRCR3R7R6uRmRXRYRiRTR9RA
  • TLSH
    T197E6B032B6E445AAC2BFD274C06206227FB1B8675326FB8B5F8055ED1D63BD0AD19313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2