Extracted

• • Target
    2026-09-04_857781e569bf57af4259e1650ef6cabf_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 12.3MB
  • SHA256 fa6375be26b79f27dd85025ff56d98d04685c126bca92c03ebc8b11d67ce1836
  • MD5 857781e569bf57af4259e1650ef6cabf
  • SHA1 2e86595990047bdbebb30635084b3d15cb5bbf35
  • SHA512 54b0d6d754fb5e81ccf6621decbfd582ea6d5289f002069e7c2d76b2cbaca314a62337c5c7cd6b15cc1a65cd9a315600f39cbe8aaffd2747231371728fed3ec6
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhRhhRvhR/hRDhRshR+hRKhRqhRl:DAkLRLRrR5RJRlRQRaReR+Rl
  • TLSH
    T1F8D6B032B6E445EAC2BFE274C06206217EB1B8675326FB8B5F8055ED1D63BD0AD19313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2