gh0strat

General

Target

13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe
Size

4.2MB
Sample

240425-z399tafa5x
MD5

4c58759c45f46521be07f90c3adaa668
SHA1

38ff78c6baa4df67808f9c4cda99722d9ad44c9f
SHA256

13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe
SHA512

2a6125c2daabe92b3700bad985b61ee2da71e6484576196b5fbe61f5f1cbef55565db58e83c3e0546a61675791cabd241c3644d29c508e71c4132a0302b4666d
SSDEEP

98304:2GdVTVT9nOgmhm1qvf6ijFUsPeeD2hnYJMOgZ:lRT9nO701qvfzjSoDuYJJi

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe
- Size
  
  4.2MB
- MD5
  
  4c58759c45f46521be07f90c3adaa668
- SHA1
  
  38ff78c6baa4df67808f9c4cda99722d9ad44c9f
- SHA256
  
  13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe
- SHA512
  
  2a6125c2daabe92b3700bad985b61ee2da71e6484576196b5fbe61f5f1cbef55565db58e83c3e0546a61675791cabd241c3644d29c508e71c4132a0302b4666d
- SSDEEP
  
  98304:2GdVTVT9nOgmhm1qvf6ijFUsPeeD2hnYJMOgZ:lRT9nO701qvfzjSoDuYJJi
Score

10^/10

gh0strat purplefox sality backdoor evasion persistence rat rootkit trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Modifies firewall policy service
  evasion
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Drops file in Drivers directory
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2