Extracted

• • Target

    d4f7142b56e0f4f2134a9d446390397d7aa79691b947e76475b776f0ae97e861.exe

  • Size

    15.5MB

  • MD5

    aad5d78715baf3a4c7145fda146df364

  • SHA1

    f7202adb66427a1616db3ec76adf285e2e81e8ac

  • SHA256

    d4f7142b56e0f4f2134a9d446390397d7aa79691b947e76475b776f0ae97e861

  • SHA512

    f079afbe44264bc349fb90f19140f03cbe70da97c535a0a04c09c69e38cd0ee330f7e331aa7995c188fdfaefb2c44488dfe61dc639fbf6587c5cb87e882a4b5c

  • SSDEEP

    196608:1cj2VCjP3Gx0GaN+hn0u50iIoysG+Xcni0iYvr00E5GqJd5igOcSWUOMzn0O1kot:ZmGxrz0utIoLv520IiBOcSWUOMr0Klzf

  Score

  10^/10

  gh0stratpurplefoxratrootkittrojanupx

  • Detect PurpleFox Rootkit

    Detect PurpleFox Rootkit.

    rootkit

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2