gh0strat

General

Target

5275276644ac3f56f304d46288a89d7548db7537a36cec29da25aa8c8bee9b19
Size

1.3MB
Sample

231211-p6d1nsgea3
MD5

49ca6cd1c91a2bea23d7b69a17fd996f
SHA1

87a4803f2bec5b64548503e7e36ac873c310ae5d
SHA256

5275276644ac3f56f304d46288a89d7548db7537a36cec29da25aa8c8bee9b19
SHA512

8ceb43e48e3cb4ce8af83e41c8b66fb530660f2161deb7fe8065ffe6d4d9e86e1867ce98fb6a0d993dea7e31bb561f02118c406eb75b73366f5a891f17b7d7ec
SSDEEP

24576:PTRRgkObgBSIibjIfCYgOXpZ+FC698tnV9susAXYW/kwNcmK/:PTznniHGCrOZuC6Y9frcGcL

Score

10^/10

Malware Config

Targets

- Target
  
  5275276644ac3f56f304d46288a89d7548db7537a36cec29da25aa8c8bee9b19
- Size
  
  1.3MB
- MD5
  
  49ca6cd1c91a2bea23d7b69a17fd996f
- SHA1
  
  87a4803f2bec5b64548503e7e36ac873c310ae5d
- SHA256
  
  5275276644ac3f56f304d46288a89d7548db7537a36cec29da25aa8c8bee9b19
- SHA512
  
  8ceb43e48e3cb4ce8af83e41c8b66fb530660f2161deb7fe8065ffe6d4d9e86e1867ce98fb6a0d993dea7e31bb561f02118c406eb75b73366f5a891f17b7d7ec
- SSDEEP
  
  24576:PTRRgkObgBSIibjIfCYgOXpZ+FC698tnV9susAXYW/kwNcmK/:PTznniHGCrOZuC6Y9frcGcL
Score

10^/10

gh0strat purplefox rat rootkit trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect PurpleFox Rootkit

Gh0st RAT payload

PurpleFox

Executes dropped EXE

Loads dropped DLL

UPX packed file

Enumerates connected drives

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2