Extracted

• • Target
    2026-08-22_6eecf283c5503b7554a979be94b4683e_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 9.9MB
  • SHA256 1cd2a9db2a975a83e78bd28b05c4274dcdace699f25c8703b6fcf48b80e613f4
  • MD5 6eecf283c5503b7554a979be94b4683e
  • SHA1 087b433af9bcca8ebf691bb5a3c0e5035692377c
  • SHA512 71ac33ea52f58bd65e7aa81783c1ab7a40033289f8bad3bb666c5b905c4a1db389b703aa9c8b80183acf6fac904e2d6d64bb2ffd0962e7383c0f6308b4b7e66d
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hRbhRphR4hR/:DAkLRLRxRtRjRER/
  • TLSH
    T11EA6AF32F9E505EAC2BFE274C06252217EB17C675331FB875F8055AA1D63BD0A92E312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2