user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Trojan:Win64/GravityRat!rfn
Trojan:Win64/GravityRat!rfn - Windows Defender threat signature analysis

Trojan:Win64/GravityRat!rfn - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Trojan:Win64/GravityRat!rfn
Classification:
Type:Trojan
Platform:Win64
Family:GravityRat
Detection Type:Concrete
Known malware family with identified signatures
Suffix:!rfn
Specific ransomware family name
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Trojan - Appears legitimate but performs malicious actions for 64-bit Windows platform, family GravityRat

Summary:

Trojan:Win64/GravityRat!rfn is a sophisticated Remote Access Trojan (RAT) capable of extensive system compromise and data exfiltration. It utilizes multiple execution techniques (e.g., mshta, regsvr32, rundll32, PowerShell), establishes persistence through scheduled tasks and BITS jobs, and employs advanced hooking for evasion. The threat can perform remote file operations, enabling comprehensive control and data theft.

Severity:
Critical
VDM Static Detection:
Relevant strings associated with this threat:
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
Known malware which is associated with this threat:
Filename: 88a03051494fc82d49b0cb772b451e47f5ebab3c2a0bd59ad4f29aa8480ad2b4
88a03051494fc82d49b0cb772b451e47f5ebab3c2a0bd59ad4f29aa8480ad2b4
29/12/2025
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate the compromised host from the network. Perform a full, deep antivirus scan and reset all user and service account credentials. Due to the sophisticated nature of GravityRat, a complete system reimage is strongly recommended to ensure thorough eradication and prevent reinfection.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 29/12/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊