Extracted

• • Target
    2026-09-05_7c8ac0b57a2a0592e96448322288a3ee_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 13.6MB
  • SHA256 65ea4f67b6195360f914895bede98829af000845efe692a9c52fbce0ff0f9e45
  • MD5 7c8ac0b57a2a0592e96448322288a3ee
  • SHA1 057efb67e30c9d4d9f759cb19e7d16338a38d25c
  • SHA512 6ca2241d049e61bae0417bcae617752e3e5909a4574266b46610f822a50ccfd04fa1ec64ba67c2ffa604dbd86dc75d4fb5a352c09ef17bbbd802cc4cbd5111d9
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hREhRqhRghRyhRchRGhRMhRShRi:DAkLRLRxRYR+RcRWRARyRwR2Ri
  • TLSH
    T1ABE6C032B6E449AAC2BFD275C06206223EB1B8675326FB8B5F8055FD1D53BD0AD19313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2