gh0strat

General

Target

b606da835b66a0ae90490d545d7b6dcae360bb16d1daac16e670d061a114e326
Size

1.2MB
Sample

241118-xrp4dsshlh
MD5

0be2c256e53cdbdc888f61876081e861
SHA1

824d252504a82165f654be9730aff498a12282e1
SHA256

b606da835b66a0ae90490d545d7b6dcae360bb16d1daac16e670d061a114e326
SHA512

784ad0a27817275172548067994c241aa4e64b35c232bfa12ac6abceeac2ef034329269b6644cb19e9e2a0eb0632757c14283477136097c0f77d71e5dd21f32d
SSDEEP

24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtid:WIwgMEuy+inDfp3/XoCw57XYBwKd

Score

10^/10

Malware Config

Targets

- Target
  
  b606da835b66a0ae90490d545d7b6dcae360bb16d1daac16e670d061a114e326
- Size
  
  1.2MB
- MD5
  
  0be2c256e53cdbdc888f61876081e861
- SHA1
  
  824d252504a82165f654be9730aff498a12282e1
- SHA256
  
  b606da835b66a0ae90490d545d7b6dcae360bb16d1daac16e670d061a114e326
- SHA512
  
  784ad0a27817275172548067994c241aa4e64b35c232bfa12ac6abceeac2ef034329269b6644cb19e9e2a0eb0632757c14283477136097c0f77d71e5dd21f32d
- SSDEEP
  
  24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtid:WIwgMEuy+inDfp3/XoCw57XYBwKd
Score

10^/10

gh0strat purplefox discovery persistence rat rootkit trojan upx vmprotect
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Purplefox family
  purplefox
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2