Extracted

• • Target
    2026-10-28_fd9c5d0190f5b43c33ab9b602ad6a3b3_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 11.3MB
  • SHA256 1ef0a3ea5f2546a22d9f6bde965a8adb8b0baf40270f51b6a926cc18fc0d902b
  • MD5 fd9c5d0190f5b43c33ab9b602ad6a3b3
  • SHA1 0ce5696a6055cd966fd6ea2fe955ad9ed9bfc4e6
  • SHA512 d4f053c9a5825547385c6fb2d29d34e6c599622e3a5e9930583049c1421970a84539ce571ed2deebf1a06d81bccb4a5eec8ee4d4d178505f870daa8bf75ed764
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRBhR3hRbhRchRKhRuhRxhRE:DAkLRLRxRtRAReRKR7RE
  • TLSH
    T142C6B032F6E405EAC2BFE274C06246217EB178675326FB8B5F8055E91D63BD0A91E313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverygravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2