Extracted

• • Target
    2026-10-26_57fe5ca2c47160ba55c3da7be90cc4a4_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 11.9MB
  • SHA256 fe74670fd81aaf347e63ed1cc8cf5703e88e055bd8baa2a743a2d695225bcffd
  • MD5 57fe5ca2c47160ba55c3da7be90cc4a4
  • SHA1 5664623fd12e08db530a610ab438079ebc01de42
  • SHA512 29aa82158b56db8c6f08dde81b774f71e087428a30411cb541c3969ef80e3e31e217d53d4e2768a8ede564d17a74bbabb78e6084f758f62084317df901c8ca6b
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hRxhRehRKhRChRVhRDhR9hR9:DAkLRCR3R7R6ReRmRXRlRPR9
  • TLSH
    T1A8C6B032B6E445AAC2BFE274C06206217EB1B8675336FB8B5F8055ED1D63BD0AD19313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverygravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2