gh0strat | 20c96c12097a5d7fb3a857b30745b81227c5a2926ce29fda79cf5859657be81c

General

Target
20c96c12097a5d7fb3a857b30745b81227c5a2926ce29fda79cf5859657be81c
Size 1.3MB
Sample230829-xddhfaeg48
SHA256 20c96c12097a5d7fb3a857b30745b81227c5a2926ce29fda79cf5859657be81c
MD5 d160dccf510f5ddcbe84d265e0f8a582
SHA1 890cb1dc041e63d9c05f60668cd99603ba37be02
SHA512 3f32dce773162eb9c4fc7eaf2e06cd7ec21960f58195f242df4a7493f682a5d3e148670d235966f3a3af05114221ba1d1018e17beb0a4b9e0ca0e2b99056d57e
SSDEEP 24576:hDUHFNvyC6X3bQm1JHiMhYNU2VuFiWM5GrkQPXHMtR1tD1ZhtTGOaK0/k8D:3kmC3TGVL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

resource	yara_rule
sample	purplefox_rootkit

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20c96c12097a5d7fb3a857b30745b81227c5a2926ce29fda79cf5859657be81c

IMPHASH de6942886ea1706308de6a5dc748b51c
SHA256 20c96c12097a5d7fb3a857b30745b81227c5a2926ce29fda79cf5859657be81c
MD5 d160dccf510f5ddcbe84d265e0f8a582
SHA1 890cb1dc041e63d9c05f60668cd99603ba37be02
SHA512 3f32dce773162eb9c4fc7eaf2e06cd7ec21960f58195f242df4a7493f682a5d3e148670d235966f3a3af05114221ba1d1018e17beb0a4b9e0ca0e2b99056d57e
SSDEEP 24576:hDUHFNvyC6X3bQm1JHiMhYNU2VuFiWM5GrkQPXHMtR1tD1ZhtTGOaK0/k8D:3kmC3TGVL
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

1277129

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths