Extracted

• • Target
    2026-08-23_67957924d689e22139e41157e7734b4c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 8.0MB
  • SHA256 fc562ad83ef90ef7f66a2d86a5cbd829c8feb15cb4a4cf0b94cb31423a378e28
  • MD5 67957924d689e22139e41157e7734b4c
  • SHA1 1c06bd1d2f301617951400e1aecfb9284c3a5c83
  • SHA512 a8b388f54ea360aca4454f27bf4662e611e81312bb7c025f4623507a940f7e24b0a59b9a9fb94c0576cfc37eb67a64c56b3d03793afa33e434b9e298593796a4
  • SSDEEP 98304:/w+sy5q1SGkDwVBTwPwYfwjsCkpL2OPXYSDDSDchR9SDcESDchRKSDchRx:I+D5q1SGs2yRwtkpqShRBGhRkhRx
  • TLSH
    T1FF869E33F9E504EAC6BEE174C16253227E717C674331BB875F8055AA1A62BD0BE2E311
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2