Extracted

• • Target
    2026-10-15_f1731089244aaec6318a6b6a24f5ab43_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 11.1MB
  • SHA256 071637107061695facb7870de2f92c77b5b0c2ba2e47bd7ecc93edf946ebd4a0
  • MD5 f1731089244aaec6318a6b6a24f5ab43
  • SHA1 0967b0a66e89fcb193c73635f29447a63f49b2bf
  • SHA512 7cc745c3af7825fb4e903bc17491e0b68e56cff960040513cd544a61e62e501f68a3fa5c96ba2881002598a64ab95efd9576934a8b218f603062b088399985c2
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hRxhRrhRfhRthRihRY:DAkLRCR3R7R9RpR/RGRY
  • TLSH
    T163C6BF32F6E405EAC2BFE274C06252217EB178675336FB8B5F8055E91D63BD0A91E312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverygravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2