Extracted

• • Target
    2026-08-22_59c8259bb310f8086203d6f725ea27bc_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 9.2MB
  • SHA256 b5c761d8698251000a2bbb357144468600e81aee241b640d6ad8d5b1b7461ddc
  • MD5 59c8259bb310f8086203d6f725ea27bc
  • SHA1 fe8464dde0127f130540612c293a22fa8c74974b
  • SHA512 120fd6ef59bda1583a459edf896bde0efb2fdf5609bbfb3657b6045c99d134f1107e9275e840cb96d801e44f8c1716847e465a0181afc6d0dc9d1ccbbf42229b
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hREhR/hRh:DAkLRLRxRYRJRh
  • TLSH
    T1C5A6BF32F9E504EAC2BFE174C16252227EB17C675331BB875F8055AA1E63BD0AD2E311
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2