Extracted

• • Target
    2026-10-30_55de0c585524de8d82915785ba26a4b4_cobalt-strike_coinminer_glassworm_poet-rat_sliver_snatch
  • Size 11.9MB
  • SHA256 1e1f8a794c8fc8ee388165e17092d324f6cb2b056b45eda95057f43c68835d96
  • MD5 55de0c585524de8d82915785ba26a4b4
  • SHA1 fc740b1f3eef6d8d78ee4e5504a6c2ffb3679b3a
  • SHA512 a9501c7f9f680851f930c0e3fbbaf176349cce0eae486e2da8eb75418a04769ad7ed68f4ac1477e63644dfac8320583105a3a839679c922b107da15e397d4ecf
  • SSDEEP 196608:I+D5q1SGs2yRwtkpqShRWhR1hRxhRehRKhRChRVhRhhRbhRc:DAkLRCR3R7R6ReRmRXRrRtRc
  • TLSH
    T1C6C6B032B6E445AAC2BFE274C06206217EB1B8675336FB8B5F8055ED1D63BD0AD19313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverygravityratpersistence

  • Family: GravityRAT

    GravityRAT is a cross-platform malware an Android, macOS and Windows based RAT first seen in 2015.

    backdoorgravityrat

  • Detects executables referencing virtualization MAC addresses

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2