Extracted

• • Target
    2026-08-25_d53a65875456e94e639e137cede8c58b_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 10.4MB
  • SHA256 0c7d7915216b5e462a2deac52dc7fe08bf276ad98ae215db17ed413d89726de9
  • MD5 d53a65875456e94e639e137cede8c58b
  • SHA1 c60726fced509b63dde0e62a4c584e26bc9f730d
  • SHA512 4da0838ddca019a729ff2b90de8289fca9ef2c356bba116022e7a70169689348c58a331089ed653bfa288d0481175a00d0c18dc01c0af34d5208d76434bc64d4
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhRhhRRhRQhRFhRyhRX:DAkLRLRrRbRMRHRWRX
  • TLSH
    T1ABB6AF32F5E405EAC2BFE274C06252217EB178675326FB8B5F8055E91D63BD0AD2E312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2