gh0strat | 94beb32181e321ef10e85ee652f1ef1e602c252d6c7d4593c556a6bfcec1d4f0[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
94beb32181e321ef10e85ee652f1ef1e602c252d6c7d4593c556a6bfcec1d4f0.dll
Size 1.2MB
Sample241118-qbhaaaskbj
SHA256 94beb32181e321ef10e85ee652f1ef1e602c252d6c7d4593c556a6bfcec1d4f0
MD5 d4852875c3dc6e21736c3daa4e22a1b9
SHA1 bf49ea2e7649eb75e3ba5635cf9634e58add229b
SHA512 3664251c8c35b114a83c72115dbd107c6c1e5a50524c21d2601a9bfab134f1694696f37e1889a635d17e60f26b1dbbd1d579076bfee49a49b8dbfc9d1bafaa41
SSDEEP 24576:rY/e8/SWTObbGMuZiRN06C7slAGZM5GrkQPXHMtR1tD1b8tTsR1K0y1k:XXrCWTsL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rootkit gh0strat purplefox

Malware Config

Signatures

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
sample	purplefox_rootkit

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat
Purplefox family
purplefox

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94beb32181e321ef10e85ee652f1ef1e602c252d6c7d4593c556a6bfcec1d4f0.dll

File Explorer

94beb32181e321ef10e85ee652f1ef1e602c252d6c7d4593c556a6bfcec1d4f0.dll

.dll 1.2MB

94beb32181e321ef10e85ee652f1ef1e602c252d6c7d4593c556a6bfcec1d4f0.dll

IMPHASH 0d8db390cee77abf4b6e0f5842817f35
SHA256 94beb32181e321ef10e85ee652f1ef1e602c252d6c7d4593c556a6bfcec1d4f0
MD5 d4852875c3dc6e21736c3daa4e22a1b9
SHA1 bf49ea2e7649eb75e3ba5635cf9634e58add229b
SHA512 3664251c8c35b114a83c72115dbd107c6c1e5a50524c21d2601a9bfab134f1694696f37e1889a635d17e60f26b1dbbd1d579076bfee49a49b8dbfc9d1bafaa41
SSDEEP 24576:rY/e8/SWTObbGMuZiRN06C7slAGZM5GrkQPXHMtR1tD1b8tTsR1K0y1k:XXrCWTsL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect PurpleFox Rootkit

Detect PurpleFox Rootkit.

rootkit
Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

185499

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

Process32First GetSystemDirectoryA TerminateProcess OpenProcess ExitProcess GetVersion DeviceIoControl Beep GetVersionExA GetModuleFileNameA WinExec TerminateThread GetTickCount GetCommandLineA FreeConsole GetCurrentProcessId GetConsoleProcessList AttachConsole GetWindowsDirectoryA WideCharToMultiByte MultiByteToWideChar GlobalSize QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryW GlobalMemoryStatusEx GetDriveTypeA ReleaseMutex CreateMutexA GetCurrentThread GetEnvironmentVariableA GetCurrentThreadId CreatePipe lstrcpyW Module32Next lstrcmpiA Module32First CreateRemoteThread GetProcessId ResumeThread OpenThread Thread32Next Thread32First SuspendThread Process32Next GlobalMemoryStatus GetComputerNameA GetPrivateProfileStringA SystemTimeToTzSpecificLocalTime lstrcpynA lstrcmpA lstrcatA CreateProcessA GetProcAddress lstrcpyA CreateDirectoryA GetLastError DeleteFileA GetCurrentProcess IsWow64Process SetFilePointer WriteFile CreateFileA GetFileSize ReadFile lstrlenA FreeLibrary IsBadReadPtr VirtualProtect HeapReAlloc HeapAlloc GetProcessHeap HeapFree CancelIo SetEvent ResetEvent CreateEventA LocalAlloc LocalReAlloc LocalSize LocalFree Sleep GetFileAttributesA GetModuleHandleA GetLocalTime GlobalAlloc GlobalLock GlobalFree GlobalUnlock CreateThread VirtualAlloc EnterCriticalSection LeaveCriticalSection VirtualFree DeleteCriticalSection InitializeCriticalSection InterlockedExchange CreateToolhelp32Snapshot GetFileAttributesExA FileTimeToSystemTime MoveFileA SetFileAttributesA RemoveDirectoryA FindFirstFileA FindNextFileA FindClose GetLogicalDriveStringsA GetVolumeInformationA GetPriorityClass GetDiskFreeSpaceExA WaitForSingleObject CloseHandle LoadLibraryA GetSystemInfo

user32

SetRect GetCursorPos GetCursorInfo PostMessageA SetCursorPos WindowFromPoint SetCapture MapVirtualKeyA SystemParametersInfoA ReleaseDC BlockInput DestroyCursor LoadCursorA GetDC GetSystemMetrics ChangeDisplaySettingsA FindWindowA ShowWindow MoveWindow GetWindowRect SwapMouseButton ExitWindowsEx EnumWindows GetKeyState GetAsyncKeyState GetForegroundWindow GetWindowTextA CharNextA GetDesktopWindow wsprintfA EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard GetWindowLongA PostQuitMessage SetWindowLongA LoadIconA SetClassLongA DestroyWindow SetFocus GetWindowTextLengthA SetWindowTextA SetDlgItemTextA CreateDialogIndirectParamA GetDlgItem SetWindowPos OpenInputDesktop GetDlgItemTextA CloseDesktop GetThreadDesktop GetUserObjectInformationA SetThreadDesktop GetWindowThreadProcessId WaitForInputIdle GetClassNameA GetWindow GetLastInputInfo IsIconic MessageBoxA IsWindowVisible GetMessageA IsDialogMessageA TranslateMessage SendMessageA DispatchMessageA

gdi32

GetDeviceCaps CreateDIBSection CreateCompatibleDC DeleteObject DeleteDC BitBlt GetRegionData CombineRgn CreateRectRgnIndirect GetDIBits CreateCompatibleBitmap SelectObject

advapi32

RegOpenKeyA GetTokenInformation LookupAccountSidA AbortSystemShutdownA RegCloseKey RegOpenKeyExA GetUserNameA CloseEventLog ClearEventLogA OpenEventLogA RegSetValueExA RegCreateKeyA StartServiceA CloseServiceHandle OpenServiceA OpenSCManagerA SetServiceStatus DeleteService FreeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor AllocateAndInitializeSid RegEnumValueA RegEnumKeyExA RegQueryValueExA RegDeleteValueA RegDeleteKeyA RegQueryInfoKeyA RegCreateKeyExA UnlockServiceDatabase ChangeServiceConfigA LockServiceDatabase ControlService QueryServiceStatus QueryServiceConfig2A QueryServiceConfigA EnumServicesStatusA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken CheckTokenMembership

shell32

ShellExecuteExA SHGetFolderPathA SHGetSpecialFolderPathA SHGetFileInfoA ShellExecuteA

ole32

CoUninitialize CoCreateInstance CoInitialize

oleaut32

SysFreeString

mfc42

ord825 ord823 ord801 ord540 ord541 ord800 ord3811 ord860 ord2614 ord668 ord6883 ord941 ord3181 ord3304 ord3010 ord3310 ord3324 ord4215 ord1980 ord3178 ord4058 ord2781 ord2770 ord922 ord537 ord858 ord356 ord1979 ord2764 ord6874 ord5572 ord5442 ord2915 ord4204 ord665 ord5186 ord354 ord6143 ord2818 ord4202 ord924 ord926 ord3663 ord6876 ord939 ord536 ord535 ord5710 ord6282 ord2763 ord4278 ord6662 ord4129 ord2784 ord6283 ord940 ord5440 ord6383 ord6394 ord2919 ord5450

msvcrt

_adjust_fdiv _initterm _onexit __dllonexit ??1type_info@@UAE@XZ _snprintf swprintf _splitpath strncpy atol strncat realloc fgets srand time isdigit _iob _access wcstombs mbstowcs _errno _wcsupr _strcmpi _itoa _strnicmp fprintf sscanf getenv vsprintf exit __CxxFrameHandler memmove ceil _ftol strstr wcslen wcscpy sprintf printf fclose fopen remove atoi free malloc strncmp _CIpow floor strchr tolower _CxxThrowException _stricmp _except_handler3 strrchr _strlwr wcsstr rand system

msvcp60

??0_Lockit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ?_Xlen@std@@YAXXZ ?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Xran@std@@YAXXZ ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z ?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ

winmm

mciSendStringA waveInGetNumDevs

ws2_32

gethostname inet_addr getsockname bind getpeername accept listen sendto recvfrom ntohs inet_ntoa send closesocket recv select gethostbyname connect setsockopt WSAIoctl WSACleanup WSAStartup __WSAFDIsSet ioctlsocket socket htons

iphlpapi

GetIfTable

dwmapi

DwmIsCompositionEnabled ord102

shlwapi

PathFindFileNameA PathUnquoteSpacesA PathRemoveArgsA PathGetArgsA SHDeleteKeyA

wininet

InternetGetConnectedState InternetReadFile HttpSendRequestA InternetOpenUrlA HttpOpenRequestA InternetOpenA InternetConnectA InternetCloseHandle HttpQueryInfoA

netapi32

NetUserSetInfo NetUserAdd NetUserGetLocalGroups NetApiBufferFree NetUserGetInfo NetUserEnum NetLocalGroupAddMembers NetUserDel

psapi

GetProcessMemoryInfo GetModuleFileNameExA

wtsapi32

WTSEnumerateSessionsA WTSDisconnectSession WTSLogoffSession WTSQuerySessionInformationA WTSFreeMemory WTSQuerySessionInformationW

Name

.text

Size

608KB

Virtual Size

607KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rotext

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

268KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

200KB

Virtual Size

634KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

36KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=49, version=9044,

count=6, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=58, id=48, version=9044,

count=75, productName=Unmarked objects (old),

count=1, id=11, version=8047,

count=4, id=10, version=8047,

count=4, id=4, version=8047,

count=7, id=12, version=7291,

count=7, id=14, version=7299,

count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=2, id=4, version=9782,

count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=31, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=507, id=1, productName=Unmarked objects,

count=1, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=35, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,