Extracted

• • Target
    2026-10-25_910309abec447d08174a1020e36aa76f_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 11.9MB
  • SHA256 c26b301abd9efb89b5afeecad7e633f02867607700338e57020090139faa171d
  • MD5 910309abec447d08174a1020e36aa76f
  • SHA1 10334fd43fa9e7b134206f5a35278ff8eb8eab4c
  • SHA512 f04cd4c444e434be7d3f112985482d3938b4299f49a77461fd04b8ea2d0eb313dfba1de459c5d158937e8dbb79b4f6aa48625be37e708ffcf2dde9ee81accbd3
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hRxhRehRKhRChRVhRihRxhRj:DAkLRCR3R7R6ReRmRXRGR7Rj
  • TLSH
    T117C6B032B6E445AAC2BFE274C06206217EB1B8675336FB8B5F8055ED1D63BD0AD19313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverygravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2