Extracted

• • Target
    2026-09-04_56aa907e6108bb737a559d6f55d12def_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 9.6MB
  • SHA256 89a1419d767c10f448077860b8d50fd2bb62047df30e93959ede2a29850960b1
  • MD5 56aa907e6108bb737a559d6f55d12def
  • SHA1 6c94cfc25afdc2dab31e585a9c186c63020711c7
  • SHA512 7008bb3193f53758aba9bb6780a3a6d5ed9d2123e2961608ec15f367012266f6e807e13d8b48c21faed4b58a1d854ebd1a56891fbb11310be724a26d128bbd7d
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hR4hRZhR5hRe:DAkLRCR3RERTRzRe
  • TLSH
    T197A6AF32F9E504EAC2BFE274C16152217EB17C675331FB875F8055AA1E62BD0AD2E312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2