Extracted

• • Target
    2026-09-01_32426e1a3d9efe932467846f55c817ff_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 13.6MB
  • SHA256 2c244561213aae97e46fd24cedab9ba44d250f7461fb32756edfc3c8f88b08b1
  • MD5 32426e1a3d9efe932467846f55c817ff
  • SHA1 3bb73809a27a4ee3dea534d7396372001a098b90
  • SHA512 6dd81fc57a1da456208a496b5129b826d821a9b3fdbd77f7562caba8cb0de496892141eadca2d67a5b5cf4fc394d325c75ebd06f34a80629a2fb9d1022a55b28
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hREhRuhRkhRhhR6hRvhRqhREhRs:DAkLRLRxRYRKR4RrROR5R+RYRs
  • TLSH
    T141E6C032B6E449AAC2BFD275C06206223EB1B8675326FB8B5F8055FD1D53BD0AD19313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2