Extracted

• • Target
    2026-09-21_3e260025a22d936a96188e5651807a60_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 13.7MB
  • SHA256 07e85e33530a054825064a6c36448ae4c35e9b099347a2da2dc20b5ea36600ce
  • MD5 3e260025a22d936a96188e5651807a60
  • SHA1 ac4988799a57558922fe3a0270298f3a4b0aef9d
  • SHA512 9ef2fbb47d5ec436c1acb7d68cacca0207f9bd59865de13f53c51bff329b6f483e645adbec154218844ea54744cfac93ca9cf0f68de28392b1a89d5109f36325
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hREhRwhR/hRLhRZhRqhRUhRChR+:DAkLRLRxRYRsRJRdRTR+RoRmR+
  • TLSH
    T184E6C032B6E449AAC2BFD275C06206223FB1B8675326FB8B5F8055ED1D53BD0AD19313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorgravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2