gh0strat | 94ccd38497eb752e75e752208e94b81adfc6504203ab47bf2e9f51e880161398

General

Target

94ccd38497eb752e75e752208e94b81adfc6504203ab47bf2e9f51e880161398
Size

31.2MB
MD5

7a9949698794f03cd2b3361b8325af59
SHA1

a704348510472392e565a722c3d52996d60df8dd
SHA256

94ccd38497eb752e75e752208e94b81adfc6504203ab47bf2e9f51e880161398
SHA512

bc8db923203288267b4cbc351d2d3aa043cb7d6d295ce94d14a37b9b85632cef67fd86aecde89bc871b6779a29e7c8c4fdec54ce6b2c458f8979274f92b6f7fb
SSDEEP

196608:m0j2VCjP3Gx0GaN+hn0u50iIoysG+Xcni0iYvr00E5GqJd5igOcSWUOMzn0O1koV:6mGxrz0utIoLv520IiBOcSWUOMr0Klz

Score

10^/10

Detect PurpleFox Rootkit 1 IoCs
Detect PurpleFox Rootkit.
rootkit

Processes:

resource yara_rule

sample purplefox_rootkit
Gh0st RAT payload 1 IoCs

Processes:

resource yara_rule

sample family_gh0strat
Gh0strat family
gh0strat
Purplefox family
purplefox
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

sample upx

resource	yara_rule
sample	purplefox_rootkit

resource	yara_rule
sample	family_gh0strat

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
94ccd38497eb752e75e752208e94b81adfc6504203ab47bf2e9f51e880161398