Extracted

• • Target
    2026-10-25_703278e768b09d474af0c3ae13b02e62_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 11.9MB
  • SHA256 d0b37f4dd29f17351f8cd75a9cc29fd12bd73a5feeeb0d23abd7ec813d475c1b
  • MD5 703278e768b09d474af0c3ae13b02e62
  • SHA1 e3a7dc823fbffc55062eb5ece800d2fe40e8f3fa
  • SHA512 a8a456f5c4f3d59e1172d965fdba47237a3faf46ca5a81f76643c92dd6fe184820af4cfa5e769fa0220660efc6445aa712c7ee83940fea194bb6499038f28cb5
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hRxhRehRKhRjhRvhRWhRAhRS:DAkLRCR3R7R6ReRFR5RCR8RS
  • TLSH
    T151C6B032B6E445AAC2BFE274C06106217EB1B8675336FB8B5F8055ED1D63BD0AD1A313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverygravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2