Extracted

• • Target
    2026-08-23_6040a1b8e533620837ffcdc8eec44d04_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 11.4MB
  • SHA256 f9fc5922597e50f3633c256f5bc48898bd8d7847699f2f46c009b996c1a195ca
  • MD5 6040a1b8e533620837ffcdc8eec44d04
  • SHA1 487a3c01c8df4cecd586648c358a502f1e6513f4
  • SHA512 de4d4feb4d8268ade4306ae2c08fa2ad878d681cbd1312c5fd201c82eacd5f93c368614534d4d0208eb178f2c9ba3458552707fe9bf12357ed91e7f4c6706529
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hRbhRfhRAhRdhRshRp:DAkLRLRxRtRpR8RvRQRp
  • TLSH
    T1C9C6B032F6E405EAC2BFE274C06216217EB178675326FB8B5F8055E91D63BD0AD1A313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2