Extracted

• • Target
    2026-10-22_e99b19b1a7d35f4a02e05085c4c045d2_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 14.0MB
  • SHA256 bab4ee5af23dd4749ce63cf390a5b0a2a5b0de1a9a5fcdb948b4df737ff4e95d
  • MD5 e99b19b1a7d35f4a02e05085c4c045d2
  • SHA1 24db7db85ab5334ef8e50424421b41eb82dfecb7
  • SHA512 c22dfb552b984e0bbca4238b4f6a59db93630ddcd1b0dd2ce052f0575f815b5db8783b8400dfb89af9a830c585efc528146a3598646b2e1a7924edee0c9779c7
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hRxhRehahRChRVhRghRfhR6hRdhRyhRR:DAkLRCR3R7R6uRmRXRcRpRORvRWRR
  • TLSH
    T18EE6C032B7E449AAC2BFD275C06206222FF1B8675326FB8B5F8055ED1D53BD0A919313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverygravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2