Extracted

• • Target
    2026-10-27_e50d7bd577ca1e39cd83b184463cc0e2_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 12.6MB
  • SHA256 a082469a66cea28c5946710307d7ffbe9d728dbd0233a0785b3ef0aeca0df670
  • MD5 e50d7bd577ca1e39cd83b184463cc0e2
  • SHA1 9c2e745fd770f8820849faf888063d63a2f2f533
  • SHA512 2ef72cbcb2e602925fadef4c2ca83bae95361052f0115ee74af67426a41af8b0918b89d2ffe4ac40d653012d00c6f6d4230e8aaf8f170fbf92c8c2b1b95a7b39
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hRxhRehRthRIhR3hRohRThRHhRJ:DAkLRCR3R7R6R/RURxR0R1RBRJ
  • TLSH
    T18CD6B032B6E445AAC2BFE274C06206217EB1B8675336FB8B5F8055ED1D63BD0AD19313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverygravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2