Extracted

• • Target
    2026-10-22_2dbad82a9dda5303095415a6e6259d4d_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 14.2MB
  • SHA256 a799c6e9aa082164e03ff6116d2fa05c69b148ac4fe174285455b72be8218c11
  • MD5 2dbad82a9dda5303095415a6e6259d4d
  • SHA1 410a9277c5caf7280bca2bbc068c4365f02d8fd9
  • SHA512 c926248bbf76e0cc87fdcc3ad19552f92d84effeacc7b9e59bd4d31599ad522cbf59bc0173faf774c001fbe0aa7240397231d8d3578a0fa308bd69b503a38b8f
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hRxhRehRKhRjhRkhRshRShRuhRXhRJhRC:DAkLRCR3R7R6ReRFR4RQR2RKRRRDRC
  • TLSH
    T1ABE6C032B7E449AAC2BFD274C06206226EF1B8675326FB8B5F8055ED1D53BD0AD19313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverygravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat
  • Custom signature

    Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2