Extracted

• • Target
    2026-10-30_7b65c64d5a1e4f3012b2780931ac57c5_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 11.9MB
  • SHA256 1fdc4b95201ac9b18be1f11ffc2c11610b3faf3f6eec8e7f979dcffa62177bde
  • MD5 7b65c64d5a1e4f3012b2780931ac57c5
  • SHA1 29746082c37b900d5a69c2049d37d962a4dcb6b1
  • SHA512 3410315c9428f962f57231707d9c4d490b1fe084bb7df2ee88ec7e3c6e3ee7878024244817d85c9072b8fdcbd94a3eec14a7064033163311817216aa0cdf82fd
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hRxhRehRKhRChRVhRDhR9hRG:DAkLRCR3R7R6ReRmRXRlRPRG
  • TLSH
    T16BC6B032B6E445AAC2BFE274C06106217EB1B8675336FB8B5F8055ED1D63BD0AD1A313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverygravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2