gh0strat | 4e4d534a25c32ce72a7b23e3cd839880_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target
4e4d534a25c32ce72a7b23e3cd839880_NEIKI
Size 1.7MB
Sample240507-18gp5adf62
SHA256 f2911cd860fade351a8ad0621f0c62b39f77fdba64a3a0e49451de32cf396405
MD5 4e4d534a25c32ce72a7b23e3cd839880
SHA1 8251ebd5cd4e9ffbd45fe747faae787ca0ec1b9d
SHA512 a6ae2dd00a3cbc68abccc8a6417450de8f0a180c29f0df5d4f597088fe38dcd7d561b1a7ed04f81e4f871b079e08bc8ca344381e2252897b18d550b6091efc36
SSDEEP 24576:TwqKPGAaCgIw6c4ciph64vSMDighMKM5rSjLmwEMtRGwmof6tTn2jEx5M1K0Y:TAncqcTnJ5R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rootkit gh0strat purplefox

Malware Config

Signatures

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
sample	purplefox_rootkit

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat
Purplefox family
purplefox

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e4d534a25c32ce72a7b23e3cd839880_NEIKI

File Explorer

4e4d534a25c32ce72a7b23e3cd839880_NEIKI

.dll 1.7MB

4e4d534a25c32ce72a7b23e3cd839880_NEIKI

IMPHASH beb77c63d50729b6f9289f0838720b7c
SHA256 f2911cd860fade351a8ad0621f0c62b39f77fdba64a3a0e49451de32cf396405
MD5 4e4d534a25c32ce72a7b23e3cd839880
SHA1 8251ebd5cd4e9ffbd45fe747faae787ca0ec1b9d
SHA512 a6ae2dd00a3cbc68abccc8a6417450de8f0a180c29f0df5d4f597088fe38dcd7d561b1a7ed04f81e4f871b079e08bc8ca344381e2252897b18d550b6091efc36
SSDEEP 24576:TwqKPGAaCgIw6c4ciph64vSMDighMKM5rSjLmwEMtRGwmof6tTn2jEx5M1K0Y:TAncqcTnJ5R
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect PurpleFox Rootkit

Detect PurpleFox Rootkit.

rootkit
Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

176341

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

Process32First TerminateProcess OpenProcess ExitProcess GetVersion DeviceIoControl Beep GetVersionExA GetModuleFileNameA WinExec TerminateThread GetTickCount GetCommandLineA FreeConsole GetCurrentProcessId GetConsoleProcessList AttachConsole WideCharToMultiByte MultiByteToWideChar GlobalSize QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryW GlobalMemoryStatusEx Process32Next GetSystemDirectoryA GetWindowsDirectoryA ReleaseMutex CreateMutexA GetCurrentThread GetEnvironmentVariableA GetCurrentThreadId lstrcpyW Module32Next lstrcmpiA Module32First CreateRemoteThread GetProcessId ResumeThread OpenThread Thread32Next Thread32First SuspendThread GetPriorityClass GlobalMemoryStatus GetComputerNameA GetPrivateProfileStringA SystemTimeToTzSpecificLocalTime lstrcpynA lstrcmpA CreateToolhelp32Snapshot GetFileAttributesExA FileTimeToSystemTime MoveFileA SetFileAttributesA RemoveDirectoryA FindFirstFileA FindNextFileA FindClose GetLogicalDriveStringsA GetProcAddress GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA lstrcatA CreateProcessA lstrcpyA CreateDirectoryA GetLastError DeleteFileA GetCurrentProcess IsWow64Process SetFilePointer WriteFile GetFileAttributesA CreateFileA GetFileSize ReadFile lstrlenA FreeLibrary IsBadReadPtr VirtualProtect HeapReAlloc HeapAlloc GetProcessHeap HeapFree Sleep CancelIo SetEvent ResetEvent CreateEventA LocalAlloc LocalReAlloc LocalSize LocalFree GetModuleHandleA GetLocalTime GlobalAlloc GlobalLock GlobalFree GlobalUnlock CreateThread VirtualAlloc EnterCriticalSection LeaveCriticalSection VirtualFree DeleteCriticalSection InitializeCriticalSection InterlockedExchange WaitForSingleObject CloseHandle LoadLibraryA GetSystemInfo

user32

ShowWindow wsprintfA MessageBoxA CharNextA GetWindowTextA GetForegroundWindow GetAsyncKeyState GetKeyState EnumWindows ExitWindowsEx SwapMouseButton GetWindowRect MoveWindow FindWindowA ChangeDisplaySettingsA GetSystemMetrics CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetDesktopWindow GetWindowLongA LoadCursorA DestroyCursor BlockInput ReleaseDC SystemParametersInfoA MapVirtualKeyA SetCapture WindowFromPoint SetCursorPos GetClipboardData PostMessageA GetCursorInfo GetCursorPos SetThreadDesktop IsWindowVisible GetWindowThreadProcessId WaitForInputIdle GetLastInputInfo GetWindow GetClassNameA SetRect SendMessageA DispatchMessageA GetThreadDesktop TranslateMessage PostQuitMessage SetWindowLongA LoadIconA SetClassLongA DestroyWindow GetDlgItemTextA SetFocus GetWindowTextLengthA SetWindowTextA SetDlgItemTextA CreateDialogIndirectParamA GetDlgItem SetWindowPos GetMessageA IsDialogMessageA GetUserObjectInformationA OpenInputDesktop CloseDesktop GetDC

gdi32

CreateCompatibleBitmap GetDIBits CreateRectRgnIndirect CombineRgn GetRegionData BitBlt DeleteDC DeleteObject CreateCompatibleDC CreateDIBSection SelectObject GetDeviceCaps

advapi32

QueryServiceConfigA GetTokenInformation LookupAccountSidA AbortSystemShutdownA RegOpenKeyA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges EnumServicesStatusA QueryServiceConfig2A QueryServiceStatus ControlService RegCloseKey RegOpenKeyExA GetUserNameA SetFileSecurityA ConvertStringSecurityDescriptorToSecurityDescriptorA CloseEventLog ClearEventLogA OpenEventLogA RegSetValueExA RegCreateKeyA StartServiceA CloseServiceHandle OpenServiceA OpenSCManagerA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegEnumValueA RegEnumKeyExA RegQueryValueExA RegDeleteValueA RegDeleteKeyA RegQueryInfoKeyA RegCreateKeyExA UnlockServiceDatabase ChangeServiceConfigA LockServiceDatabase DeleteService

shell32

SHGetSpecialFolderPathA ShellExecuteA SHGetFileInfoA SHGetFolderPathA ShellExecuteExA

ole32

CoInitialize CoCreateInstance CoUninitialize

oleaut32

SysFreeString

mfc42

ord5440 ord940 ord6283 ord2784 ord6662 ord2763 ord6282 ord5710 ord536 ord939 ord6876 ord6394 ord5450 ord2044 ord5834 ord535 ord4278 ord6663 ord4277 ord4129 ord2448 ord3663 ord1140 ord926 ord924 ord4202 ord2818 ord6143 ord354 ord5186 ord665 ord4204 ord2915 ord5442 ord5572 ord6874 ord2764 ord1979 ord356 ord858 ord537 ord922 ord2770 ord2781 ord4058 ord3178 ord1980 ord4215 ord3324 ord3310 ord3010 ord3304 ord3181 ord941 ord6883 ord668 ord2614 ord860 ord3811 ord800 ord541 ord540 ord801 ord825 ord823 ord6383

msvcrt

rand system remove _splitpath strncpy atol strncat realloc wcsstr _errno mbstowcs wcstombs _snprintf ??1type_info@@UAE@XZ __dllonexit _onexit _initterm _adjust_fdiv _strlwr strrchr _except_handler3 _stricmp _CxxThrowException tolower strchr floor _CIpow strncmp __CxxFrameHandler memmove _iob _ftol malloc wcslen wcscpy sprintf atoi free _wcsupr _strcmpi _itoa _access _strnicmp exit fprintf sscanf getenv vsprintf strstr ceil

msvcp60

??1_Lockit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0Init@ios_base@std@@QAE@XZ ?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ??0_Lockit@std@@QAE@XZ

winmm

waveInGetNumDevs mciSendStringA

ws2_32

bind sendto inet_addr gethostname ntohs getpeername recvfrom __WSAFDIsSet ioctlsocket WSAStartup accept inet_ntoa listen closesocket getsockname WSACleanup WSAIoctl setsockopt connect htons gethostbyname socket send recv select

iphlpapi

GetIfTable

dwmapi

ord102 DwmIsCompositionEnabled

shlwapi

PathGetArgsA PathRemoveArgsA PathUnquoteSpacesA PathFindFileNameA

netapi32

NetUserAdd NetUserGetLocalGroups NetApiBufferFree NetUserGetInfo NetUserDel NetUserSetInfo NetLocalGroupAddMembers NetUserEnum

psapi

GetProcessMemoryInfo GetModuleFileNameExA

wininet

InternetGetConnectedState InternetOpenA InternetConnectA InternetCloseHandle HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetReadFile

wtsapi32

WTSEnumerateSessionsA WTSQuerySessionInformationW WTSDisconnectSession WTSLogoffSession WTSQuerySessionInformationA WTSFreeMemory

Name

.text

Size

600KB

Virtual Size

598KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rotext

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

268KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

300KB

Virtual Size

737KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=49, version=9044,

count=6, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=58, id=48, version=9044,

count=1, id=11, version=8047,

count=4, id=10, version=8047,

count=4, id=4, version=8047,

count=7, id=12, version=7291,

count=7, id=14, version=7299,

count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=2, id=4, version=9782,

count=77, productName=Unmarked objects (old),

count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=31, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=472, id=1, productName=Unmarked objects,

count=1, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=35, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,