gh0strat | efd28451d0a1dc0f95e31d4272ddea208a8ae9a1340f5d553fe83423e8b22d0c | Triage

Submit
Reports

Overview

overview

Static

static

7

efd28451d0...0c.dll

windows7-x64

efd28451d0...0c.dll

windows10-2004-x64

Sharing

General

Target

efd28451d0a1dc0f95e31d4272ddea208a8ae9a1340f5d553fe83423e8b22d0c
Size

577KB
Sample

240925-q76mrayenm
MD5

d202f9f35392f5580c036dd53b580928
SHA1

d51d0f6f468a4e60dd102bc2066f8f6c5ba88dcb
SHA256

efd28451d0a1dc0f95e31d4272ddea208a8ae9a1340f5d553fe83423e8b22d0c
SHA512

45150236f432055d1e4c7ad293acd3f9ed8ba398a950dd8ba06bccf58fd003e6aa13bf20cd04105c7abc2762cbaa297b3ee1d8dcc9551e5ae826484d30f2b4df
SSDEEP

12288:ME8K6UN6tuZZKYdjl8zWA5rnL0C0v3LkqPVIUd5CRxSoWXXktZgc:V5pNm8Hx8zWArngCGLFNd5C/AXk

Score

10^/10

gh0strat purplefox discovery persistence rat rootkit trojan upx

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

efd28451d0a1dc0f95e31d4272ddea208a8ae9a1340f5d553fe83423e8b22d0c.dll

Resource

win7-20240903-en

gh0strat purplefox discovery persistence rat rootkit trojan upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

efd28451d0a1dc0f95e31d4272ddea208a8ae9a1340f5d553fe83423e8b22d0c.dll

Resource

win10v2004-20240802-en

gh0strat purplefox discovery persistence rat rootkit trojan upx

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  efd28451d0a1dc0f95e31d4272ddea208a8ae9a1340f5d553fe83423e8b22d0c
- Size
  
  577KB
- MD5
  
  d202f9f35392f5580c036dd53b580928
- SHA1
  
  d51d0f6f468a4e60dd102bc2066f8f6c5ba88dcb
- SHA256
  
  efd28451d0a1dc0f95e31d4272ddea208a8ae9a1340f5d553fe83423e8b22d0c
- SHA512
  
  45150236f432055d1e4c7ad293acd3f9ed8ba398a950dd8ba06bccf58fd003e6aa13bf20cd04105c7abc2762cbaa297b3ee1d8dcc9551e5ae826484d30f2b4df
- SSDEEP
  
  12288:ME8K6UN6tuZZKYdjl8zWA5rnL0C0v3LkqPVIUd5CRxSoWXXktZgc:V5pNm8Hx8zWArngCGLFNd5C/AXk
Score

10^/10

gh0strat purplefox discovery persistence rat rootkit trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Blocklisted process makes network request
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

behavioral2

gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

© 2018-2025

Terms | Privacy