Detect PurpleFox Rootkit

Detect PurpleFox Rootkit.

Gh0st RAT payload

Gh0strat

Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

Meduza

Meduza is a crypto wallet and info stealer written in C++.

Meduza Stealer payload

PurpleFox

PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

Drops file in Drivers directory

Sets DLL path for service in the registry

Sets service image path in registry