Extracted

• • Target
    2026-08-30_e17947efd792b96c35a28498505febb2_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 12.9MB
  • SHA256 b9fc1d436c83031ff180a5a1367889743c87ccaf26b446c050bf02b1a39df6f9
  • MD5 e17947efd792b96c35a28498505febb2
  • SHA1 425f7c03d532e12eee69cd48692d888d50883375
  • SHA512 6240a7744ccbd0f3e30faa28c9e72b5aca60056e41c077510e270f7d8110d4a95114aa2550e52256cd6054a5d99cfa04d47e684622e8c082136a0b45e2fd8f42
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hREhRqhROhR0hRThRshRlhRR:DAkLRLRxRYR+RqRIR1RQRnRR
  • TLSH
    T1D0D6C032B6E445AAC2BFE274C06206227FB1B8675326FB8B5F8055ED1D53BD0AD19313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2