gh0strat

General

Target

2ee5c452b778a8838a54cbd1d142ba9a960d7f7579401509f913f3ce1781beb1
Size

1.2MB
Sample

250107-wc9c2s1qay
MD5

d4b3fa6c45924a988d19a01b51f37073
SHA1

1fcaca38d2490bd79d14b5ce3faf1301e31b0e84
SHA256

2ee5c452b778a8838a54cbd1d142ba9a960d7f7579401509f913f3ce1781beb1
SHA512

b80a9de98ced190aac2f653d6ef64d5dfa7efd2e17ff02bc4154b3256c406ef0ea12f89d8687de4328efde659e92c0e355663e3079332168e3a0919016d603ab
SSDEEP

24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiy:WIwgMEuy+inDfp3/XoCw57XYBwKy

Score

10^/10

Malware Config

Targets

- Target
  
  2ee5c452b778a8838a54cbd1d142ba9a960d7f7579401509f913f3ce1781beb1
- Size
  
  1.2MB
- MD5
  
  d4b3fa6c45924a988d19a01b51f37073
- SHA1
  
  1fcaca38d2490bd79d14b5ce3faf1301e31b0e84
- SHA256
  
  2ee5c452b778a8838a54cbd1d142ba9a960d7f7579401509f913f3ce1781beb1
- SHA512
  
  b80a9de98ced190aac2f653d6ef64d5dfa7efd2e17ff02bc4154b3256c406ef0ea12f89d8687de4328efde659e92c0e355663e3079332168e3a0919016d603ab
- SSDEEP
  
  24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiy:WIwgMEuy+inDfp3/XoCw57XYBwKy
Score

10^/10

gh0strat purplefox discovery persistence rat rootkit trojan upx vmprotect
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Purplefox family
  purplefox
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2