Extracted

• • Target
    2026-09-05_7a98431328e22dcb72b8dc55b4ae71f2_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 12.0MB
  • SHA256 9ba0f0876cfe8b8237734b9247148519714932700ccf6bf511a213f53628abf1
  • MD5 7a98431328e22dcb72b8dc55b4ae71f2
  • SHA1 debf2dd9b72acbdb58b4c20f60f29c5ce71f8d88
  • SHA512 730851cdfd3bb813bd3e7b075e0f8507dd68d8337f4d0a57c604a0d11cd3034c401e1215606a28aea8071436c96550885bea26e3daea8d8c1e8c69b01745dc1e
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hREhRjhRvhR1hRkhRKhRK:DAkLRLRxRYRFR5R3R4ReRK
  • TLSH
    T105D6B032B6E445EAC2BFE274C06206217EB1B8675326FB8B5F8055ED1D63BD0AD19313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2