gh0strat | 4a5315302188a9bb75a9315ffa85328674fec201342a517c902e3044f06484d9

Sharing

Copy URL Twitter E-mail

General

Target
4a5315302188a9bb75a9315ffa85328674fec201342a517c902e3044f06484d9
Size 1.2MB
Sample241118-endbbaycrm
SHA256 4a5315302188a9bb75a9315ffa85328674fec201342a517c902e3044f06484d9
MD5 4cee16e5387c9641b14bd286d8231dd7
SHA1 5d94c8abc2b74d67e3b910e47d67c36800282f38
SHA512 e052d56778aa61161b90a5e8b964b533c7a838d6af5e96983ed12d4d7583bafcb2838e38556591343ad11d81f0e96381a13a491154f419574e843cf97d590bb2
SSDEEP 24576:aZ0ptsa8G81lWmcy9i5xKNKImCZS/xM5GrkQPXHMtR1tD1pBtTmPyRyK0M:4GLujXTmC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rootkit gh0strat purplefox

Malware Config

Signatures

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
sample	purplefox_rootkit

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat
Purplefox family
purplefox

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a5315302188a9bb75a9315ffa85328674fec201342a517c902e3044f06484d9

File Explorer

4a5315302188a9bb75a9315ffa85328674fec201342a517c902e3044f06484d9

.dll 1.2MB

4a5315302188a9bb75a9315ffa85328674fec201342a517c902e3044f06484d9

IMPHASH 349bdd13418dd9d2d14e58e98892e750
SHA256 4a5315302188a9bb75a9315ffa85328674fec201342a517c902e3044f06484d9
MD5 4cee16e5387c9641b14bd286d8231dd7
SHA1 5d94c8abc2b74d67e3b910e47d67c36800282f38
SHA512 e052d56778aa61161b90a5e8b964b533c7a838d6af5e96983ed12d4d7583bafcb2838e38556591343ad11d81f0e96381a13a491154f419574e843cf97d590bb2
SSDEEP 24576:aZ0ptsa8G81lWmcy9i5xKNKImCZS/xM5GrkQPXHMtR1tD1pBtTmPyRyK0M:4GLujXTmC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect PurpleFox Rootkit

Detect PurpleFox Rootkit.

rootkit
Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

167299

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetFileAttributesExA CreateToolhelp32Snapshot Process32Next Process32First ExitProcess GetVersion DeviceIoControl Beep MoveFileExA CopyFileA GetModuleFileNameA GetVersionExA TerminateProcess OpenProcess WinExec TerminateThread GetTickCount GetCommandLineA FreeConsole GetCurrentProcessId GetConsoleProcessList AttachConsole GetWindowsDirectoryA WideCharToMultiByte MultiByteToWideChar GlobalSize QueryPerformanceFrequency QueryPerformanceCounter FileTimeToSystemTime GlobalMemoryStatusEx GetSystemInfo GetSystemDirectoryW GetModuleFileNameW ReleaseMutex CreateMutexA GetCurrentThread GetEnvironmentVariableA GetCurrentThreadId lstrcpyW Module32Next lstrcmpiA Module32First CreateRemoteThread GetProcessId ResumeThread OpenThread Thread32Next Thread32First SuspendThread GetPriorityClass GlobalMemoryStatus GetComputerNameA GetPrivateProfileStringA SystemTimeToTzSpecificLocalTime lstrcpynA lstrcmpA GetFullPathNameW CreateFileW GetModuleHandleW MoveFileA SetFileAttributesA RemoveDirectoryA FindFirstFileA FindNextFileA FindClose GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA lstrcatA CreateProcessA lstrcpyA CreateDirectoryA GetLastError DeleteFileA GetCurrentProcess GetProcAddress IsWow64Process SetFilePointer WriteFile LocalSize GetSystemDirectoryA GetFileAttributesA CreateFileA GetFileSize ReadFile lstrlenA LocalReAlloc LocalAlloc LocalFree FreeLibrary IsBadReadPtr VirtualProtect HeapReAlloc HeapAlloc GetProcessHeap HeapFree Sleep CancelIo SetEvent ResetEvent CreateEventA GetModuleHandleA GetLocalTime GlobalAlloc GlobalLock GlobalFree GlobalUnlock CreateThread VirtualAlloc EnterCriticalSection LeaveCriticalSection VirtualFree DeleteCriticalSection InitializeCriticalSection InterlockedExchange WaitForSingleObject CloseHandle LoadLibraryA LoadLibraryW

user32

wsprintfA MessageBoxA CharNextA GetWindowTextA GetForegroundWindow GetAsyncKeyState GetKeyState EnumWindows ExitWindowsEx SwapMouseButton GetWindowRect MoveWindow FindWindowA ChangeDisplaySettingsA GetSystemMetrics GetDC LoadCursorA DestroyCursor BlockInput ShowWindow SystemParametersInfoA keybd_event MapVirtualKeyA mouse_event CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetClipboardData GetCursorInfo GetCursorPos GetClassNameA SetThreadDesktop PostMessageA IsWindowVisible GetWindowThreadProcessId WaitForInputIdle RegisterClassExA CreateWindowExA DefWindowProcA GetLastInputInfo GetWindow SendMessageA DispatchMessageA TranslateMessage CloseDesktop GetWindowLongA PostQuitMessage SetWindowLongA LoadIconA SetClassLongA DestroyWindow GetDlgItemTextA SetFocus GetWindowTextLengthA SetWindowTextA SetDlgItemTextA CreateDialogIndirectParamA GetDlgItem SetWindowPos GetMessageA IsDialogMessageA GetUserObjectInformationA GetThreadDesktop OpenInputDesktop ReleaseDC

gdi32

CreateCompatibleBitmap GetDIBits CreateRectRgnIndirect CombineRgn GetRegionData BitBlt DeleteDC DeleteObject CreateCompatibleDC CreateDIBSection SelectObject GetDeviceCaps

advapi32

GetTokenInformation LookupAccountSidA AbortSystemShutdownA RegOpenKeyA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges EnumServicesStatusA QueryServiceConfigA QueryServiceConfig2A QueryServiceStatus ControlService RegCloseKey RegOpenKeyExA GetUserNameA CloseEventLog ClearEventLogA OpenEventLogA RegSetValueExA RegCreateKeyA StartServiceA CloseServiceHandle OpenServiceA OpenSCManagerA SetServiceStatus DeleteService SetSecurityDescriptorDacl InitializeSecurityDescriptor RegEnumValueA RegEnumKeyExA RegQueryValueExA RegDeleteValueA RegDeleteKeyA RegQueryInfoKeyA RegCreateKeyExA UnlockServiceDatabase ChangeServiceConfigA LockServiceDatabase

shell32

SHGetFolderPathA SHGetSpecialFolderPathA SHGetFileInfoA ShellExecuteExA

ole32

CoInitialize CoCreateInstance CoUninitialize

oleaut32

SysFreeString

mfc42

ord940 ord2784 ord4129 ord6662 ord4278 ord2763 ord6282 ord5710 ord535 ord536 ord939 ord6876 ord3663 ord2818 ord6143 ord354 ord5186 ord665 ord4204 ord2915 ord5442 ord5572 ord6874 ord2764 ord1979 ord356 ord858 ord537 ord922 ord2770 ord2781 ord4058 ord3178 ord1980 ord4215 ord3324 ord3310 ord3010 ord3304 ord3181 ord941 ord6883 ord668 ord2614 ord860 ord3811 ord800 ord541 ord540 ord801 ord825 ord823 ord5440 ord6383 ord5450 ord6394 ord6283

msvcrt

tolower _CxxThrowException _stricmp _except_handler3 strrchr _strlwr wcsstr rand swprintf _splitpath strncpy atol strncat strchr wcscat atoi _errno mbstowcs wcstombs _snprintf ??1type_info@@UAE@XZ __dllonexit _onexit _initterm _adjust_fdiv floor _CIpow strncmp malloc __CxxFrameHandler memmove _iob _ftol free wcslen wcscpy realloc sprintf _wcsupr _strcmpi _itoa _strnicmp exit fprintf sscanf getenv vsprintf strstr ceil

msvcp60

??1_Lockit@std@@QAE@XZ ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ??0_Lockit@std@@QAE@XZ

winmm

waveInGetNumDevs mciSendStringA

ws2_32

gethostname inet_addr inet_ntoa send getsockname bind getpeername accept listen sendto recvfrom __WSAFDIsSet ioctlsocket closesocket ntohs WSAStartup WSACleanup WSAIoctl setsockopt connect recv select socket gethostbyname htons

iphlpapi

GetIfTable

shlwapi

PathGetArgsA PathFindFileNameA SHDeleteKeyA PathUnquoteSpacesA PathRemoveArgsA

netapi32

NetUserAdd NetUserGetLocalGroups NetApiBufferFree NetUserGetInfo NetUserDel NetUserSetInfo NetLocalGroupAddMembers NetUserEnum

psapi

GetProcessMemoryInfo GetModuleFileNameExA

wininet

HttpQueryInfoA HttpSendRequestA DeleteUrlCacheEntry InternetGetConnectedState InternetOpenA InternetConnectA InternetCloseHandle HttpOpenRequestA InternetReadFile

wtsapi32

WTSEnumerateSessionsA WTSQuerySessionInformationW WTSDisconnectSession WTSLogoffSession WTSQuerySessionInformationA WTSFreeMemory

Name

.text

Size

592KB

Virtual Size

590KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rotext

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

264KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

196KB

Virtual Size

629KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=49, version=9044,

count=6, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=58, id=48, version=9044,

count=75, productName=Unmarked objects (old),

count=1, id=11, version=8047,

count=4, id=10, version=8047,

count=4, id=4, version=8047,

count=6, id=12, version=7291,

count=6, id=14, version=7299,

count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=2, id=4, version=9782,

count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=31, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=444, id=1, productName=Unmarked objects,

count=1, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=32, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=2, id=18, version=8444,

count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,