Extracted

• • Target
    2026-10-25_a5a0a7187e051fea7b2f15572124a71c_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 11.9MB
  • SHA256 93c244e2ad37592ec1957830637cad4dd04fbb5ea8d7cb53c231978e4d99f48c
  • MD5 a5a0a7187e051fea7b2f15572124a71c
  • SHA1 e46e378eef2bd4020e9a2537e922fd41e0ded7df
  • SHA512 0ba3d255c4557952d58d7511d1eccb6415e7f96b9d967de26a0dfad57e39983793130ffffce8c5f8381ac10e9b002550665ee75435f87304ced2fc0d2c4ff92e
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hRxhRehRKhRChRVhRDhR9hRD:DAkLRCR3R7R6ReRmRXRlRPRD
  • TLSH
    T102C6B032B6E445AAC2BFE274C06106217EB1B8675336FB8B5F8055ED1D63BD0AD1A313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverygravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2