gh0strat

General

Target

3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd
Size

8.9MB
Sample

240924-tpecbswcle
MD5

1f9ad8367647ae321e2ab53f221ace48
SHA1

e19db0c1288c81909378852c9130983bc65cfcfb
SHA256

3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd
SHA512

7aa1aa242288397027b690d2816763e37f30b87898e781bff617085d41737cfb0a620d9b690ad1abbef3e5b95d487da2601452595d3efc1d80c2fd953b850d04
SSDEEP

196608:Dl1PkID0eA2EhGE9Fy1GlkkyzLSMo/Mpz0YIpP8L2+7/A1Yt:RFm2EgE9Fy0TOkMp1ImL2k/2Yt

Score

10^/10

Malware Config

Targets

- Target
  
  3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd
- Size
  
  8.9MB
- MD5
  
  1f9ad8367647ae321e2ab53f221ace48
- SHA1
  
  e19db0c1288c81909378852c9130983bc65cfcfb
- SHA256
  
  3b2c20bfda08e4854ee1822936404eb4080073d4a101d6a1297cf6ecf7056cbd
- SHA512
  
  7aa1aa242288397027b690d2816763e37f30b87898e781bff617085d41737cfb0a620d9b690ad1abbef3e5b95d487da2601452595d3efc1d80c2fd953b850d04
- SSDEEP
  
  196608:Dl1PkID0eA2EhGE9Fy1GlkkyzLSMo/Mpz0YIpP8L2+7/A1Yt:RFm2EgE9Fy0TOkMp1ImL2k/2Yt
Score

10^/10

gh0strat neshta purplefox discovery evasion persistence rat rootkit spyware stealer themida trojan
- Detect Neshta payload
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Drops file in Drivers directory
- Sets service image path in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2