gh0strat | 81733f0102e572a8e4af01d54208f50abcaf275bfb2a8ddb19cc5c00f61701e4 | Triage

Submit
Reports

Overview

overview

Static

static

3

81733f0102...e4.exe

windows7-x64

81733f0102...e4.exe

windows10-2004-x64

Sharing

General

Target

81733f0102e572a8e4af01d54208f50abcaf275bfb2a8ddb19cc5c00f61701e4
Size

5.0MB
Sample

240626-ammfdasfpb
MD5

d38a7c2c1b42da01492da5e33f10b93f
SHA1

0e0693cd92a49d15129a625f4520c1864ba34189
SHA256

81733f0102e572a8e4af01d54208f50abcaf275bfb2a8ddb19cc5c00f61701e4
SHA512

799723c5a8303f824707487f04e52dcbde8098cabd0068d7a0391dd6a828a1ff61ca3d9284caa33919b8d896dfadc80edd85ddd91d0b94a1caae6828bdc636b7
SSDEEP

98304:kws2ANnKXOaeOgmhPBvCn2L0LvrhFnpMAckM:yKXbeO7VBanfLvrnirr

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

81733f0102e572a8e4af01d54208f50abcaf275bfb2a8ddb19cc5c00f61701e4.exe

Resource

win7-20240221-en

gh0strat purplefox persistence rat rootkit trojan upx

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

81733f0102e572a8e4af01d54208f50abcaf275bfb2a8ddb19cc5c00f61701e4.exe

Resource

win10v2004-20240226-en

gh0strat purplefox persistence rat rootkit trojan upx

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  81733f0102e572a8e4af01d54208f50abcaf275bfb2a8ddb19cc5c00f61701e4
- Size
  
  5.0MB
- MD5
  
  d38a7c2c1b42da01492da5e33f10b93f
- SHA1
  
  0e0693cd92a49d15129a625f4520c1864ba34189
- SHA256
  
  81733f0102e572a8e4af01d54208f50abcaf275bfb2a8ddb19cc5c00f61701e4
- SHA512
  
  799723c5a8303f824707487f04e52dcbde8098cabd0068d7a0391dd6a828a1ff61ca3d9284caa33919b8d896dfadc80edd85ddd91d0b94a1caae6828bdc636b7
- SSDEEP
  
  98304:kws2ANnKXOaeOgmhPBvCn2L0LvrhFnpMAckM:yKXbeO7VBanfLvrnirr
Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Server Software Component

Terminal Services DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratpurplefoxpersistenceratrootkittrojanupx

behavioral2

gh0stratpurplefoxpersistenceratrootkittrojanupx

© 2018-2025

Terms | Privacy