gh0strat

General

Target

2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae
Size

9.5MB
Sample

240525-x4dacsfc7z
MD5

d28366b555ff3c93cfe3f2224131fbe7
SHA1

042e818ea75b1d8e57acb9379a753a9192fb1bfc
SHA256

2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae
SHA512

064d920da28b848c55e55ff90ac7fcdf33098b258f74d81f6425300cb39c0a70632cf65c515cacf9099c30649e93b2307a75c629b406f95858e39cdbce483433
SSDEEP

98304:Tws2ANnKXOaeOgmhGDmn2onw8tydtdUeitbTUOhnxidIVAP:1KXbeO7Imn/37VTb/g

Score

10^/10

Malware Config

Targets

- Target
  
  2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae
- Size
  
  9.5MB
- MD5
  
  d28366b555ff3c93cfe3f2224131fbe7
- SHA1
  
  042e818ea75b1d8e57acb9379a753a9192fb1bfc
- SHA256
  
  2d9b57cb8b78aba7bf830f7b5ded7d4fe80eb8034cbbddb972a04ec1de168aae
- SHA512
  
  064d920da28b848c55e55ff90ac7fcdf33098b258f74d81f6425300cb39c0a70632cf65c515cacf9099c30649e93b2307a75c629b406f95858e39cdbce483433
- SSDEEP
  
  98304:Tws2ANnKXOaeOgmhGDmn2onw8tydtdUeitbTUOhnxidIVAP:1KXbeO7Imn/37VTb/g
Score

10^/10

gh0strat purplefox discovery persistence rat rootkit trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Drops file in Drivers directory
- Sets DLL path for service in the registry
  persistence
- Sets service image path in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2