Extracted

• • Target
    2026-10-15_98fab2f341ab0f7adb88a13e9a45743b_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 10.4MB
  • SHA256 fd73e9f13c3efd47b7af5d55863259d29564eb076d3d14c32932e854a6916d21
  • MD5 98fab2f341ab0f7adb88a13e9a45743b
  • SHA1 4213d9608942d4a52352d8af5f43b060d4f58d7d
  • SHA512 c0b41672e1ca70f180ef67ab41e40497274dd9075386bd9c69f6df0e63adb7112e8f9016eb4899b2bf9017ae2ba560ec44bdd8454273b08f3aaf2482cd5075f0
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hRxhRrhR2hRhhRd:DAkLRCR3R7R9RiRrRd
  • TLSH
    T1F6B6BF32FAE405EAC2BFE274C06152217EB178675336FB875F8055E91D63BD0A92E312
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverygravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2