gh0strat

General

Target

yuanchangkuirr-intrallar.zip
Size

72.2MB
Sample

241023-cj8wbaweja
MD5

64d1229411000e52a09f91fc43e12525
SHA1

ca5d7b20391545e1db054230dd0a768c954c0e2b
SHA256

2bd63252d1eeec4888e0674d52d5dfa80bd69d8accd64f7fb1ea6bdcbe9d4a61
SHA512

8b9aaeff856bab09913c59231267df2e2e17658d0a8493f2ca5485ac2e4f3b814c2755f5f57447bfc717aac11fe1dbe02dbc1504c8ae03498be9fb134b18693d
SSDEEP

1572864:wvoP5zeUbppi840PhTqHgWXLhm5d1s+iGU/69IcJYpJg1GezL:jZbppD4iJqAAm5d1Vi6PV1Gen

Score

10^/10

Malware Config

Targets

- Target
  
  yuanchangkuirr-intrallar.msi
- Size
  
  72.3MB
- MD5
  
  31e8ef3c0591e3ce82cb1c43fb6459c2
- SHA1
  
  2adc3a5470d7e7507c60e6bf88d86985b2d3a7b9
- SHA256
  
  9e0543dbde32aeacb27324fc070be63ae7bf679fbe69a4836e3dab627812a7b8
- SHA512
  
  c1607b5a051fe034378dee8c27aca1effbdf4ab985a500160f2260403bace6f5575117e73a21878ec3f88d1bde49f56cc99184012cb66d1cb2bdc2a7defb4994
- SSDEEP
  
  1572864:DNDFH5QOjDdexAgZt/qNOU1bpJh11+exX8t6iwwdM1ZE0d+LH:1xjDdKAqFqQCJh11/xYP50d+7
Score

10^/10

discovery evasion execution persistence privilege_escalation upx gh0strat purplefox rat rootkit trojan
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies Windows Firewall
  evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2