Extracted

• • Target
    2026-08-23_97da46e78dec002b41a6e0ec14161f7b_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 9.7MB
  • SHA256 4b46f1233e1c4feb6181878bbcbf97f41c4d4a39509dc451282e05099f0e3a79
  • MD5 97da46e78dec002b41a6e0ec14161f7b
  • SHA1 4f3abc30a5b6c90fef79dc37e33982768bd289e3
  • SHA512 8cd80557da74bebd4fbcc2ee13a218ec9f33932fba959daeece9c0d1d8c83b57d24278908b7450323bdec3d31e758775635b2bbdc38136aee2cc41d0acd68482
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShR2hRShRjhRrhRIhRi:DAkLRiR2RFR9RURi
  • TLSH
    T137A6AF32F9E504EAC2BFE274C16252217EB178675332FB875F8055A91D63BD0AD2E312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2