Extracted

• • Target
    2026-09-01_25ba538d78b7d1d447bb18a456f25eef_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 11.2MB
  • SHA256 510d135eecefcfb0747b50c8dfe23e4824d49a510ba744edf52c42302bc52591
  • MD5 25ba538d78b7d1d447bb18a456f25eef
  • SHA1 dedd48eb047e640e2f66afe099c1d481b6c5a39b
  • SHA512 1056a18da6ded59b358e04b3307b18cc794981ba807da48eaa7cccf326bf52aeb53b77e6ab0c8336ea09a22bad6418b01769d0d1de79445400981775f124df23
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hR8hRuhRRhRXhRXhR/:DAkLRCR3RgRKRbRRRRR/
  • TLSH
    T100C6B032F6E405EAC2BFE274C06252217EB178675336FB8B5F8055E91D63BD0A92D312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2