Extracted

• • Target
    2026-08-23_9916d285aad0fd00ffe71eaf1737eab8_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 10.0MB
  • SHA256 b3e90821472c43566d9866d6c53f173948b640e6a886c32609296117b67512fa
  • MD5 9916d285aad0fd00ffe71eaf1737eab8
  • SHA1 5df51081b91c603e7ac759b2c815de64a5de059b
  • SHA512 27f4811b3acc633168d8e6bcb2b02dfb19f9b3988870dbb68ec992722dfa915186bb3ba2b4ae2bbfc304d9e38dd548101cf3485d1785eeffc894e7c248705779
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hRbhRQhRMhRMC:DAkLRLRxRtRMRwRx
  • TLSH
    T110B6BF32F9E505EAC2BFE274C06242217EB178675336FB875F8055E91D63BD0A92E312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2