gh0strat | c30dc1617c714dc0785a80d4d9791415cd2728274b57746024c46cbae065b1f2

General

Target

c30dc1617c714dc0785a80d4d9791415cd2728274b57746024c46cbae065b1f2
Size

1.5MB
MD5

aefa27635c373c441ac97d6fd7738c24
SHA1

1a2f15a65993631891675025af697813c2ea3dd5
SHA256

c30dc1617c714dc0785a80d4d9791415cd2728274b57746024c46cbae065b1f2
SHA512

aa869cee484af2de43c08ac52947054ba0a3c9fa8bb9d60237b7a673b57760f9f236b51fd41a89c63e96a6807710825dd025805febb1e781e4605eb04633815f
SSDEEP

24576:7MfywgIt/65Fu99573/aiVIOYrFzpCM5hyv3m8AMtRyce0LCOK0B:l49rJ

Score

10^/10

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

Processes:

resource	yara_rule
sample	purplefox_rootkit

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
sample	family_gh0strat

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
c30dc1617c714dc0785a80d4d9791415cd2728274b57746024c46cbae065b1f2