gh0strat

General

Target

e10edc9d9e5611d128b17275b25b3bdd4c13b1418883690cb9576a620eb3c94e
Size

1.2MB
Sample

250117-xxawnazpaw
MD5

73dead9c1815484de41a3ae8f050ccaa
SHA1

5b16edc8c50ad31c45d2c0f814cac5a77f53e76a
SHA256

e10edc9d9e5611d128b17275b25b3bdd4c13b1418883690cb9576a620eb3c94e
SHA512

bf404352f91f86188b3312a5b794160ee32a93d5a39e0649b1a2beb1c68a9a313208418f0fc9e8a917f986df85f1c365e55e94b2bb479a55fd1d3104d35441ad
SSDEEP

24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJti1:WIwgMEuy+inDfp3/XoCw57XYBwK1

Score

10^/10

Malware Config

Targets

- Target
  
  e10edc9d9e5611d128b17275b25b3bdd4c13b1418883690cb9576a620eb3c94e
- Size
  
  1.2MB
- MD5
  
  73dead9c1815484de41a3ae8f050ccaa
- SHA1
  
  5b16edc8c50ad31c45d2c0f814cac5a77f53e76a
- SHA256
  
  e10edc9d9e5611d128b17275b25b3bdd4c13b1418883690cb9576a620eb3c94e
- SHA512
  
  bf404352f91f86188b3312a5b794160ee32a93d5a39e0649b1a2beb1c68a9a313208418f0fc9e8a917f986df85f1c365e55e94b2bb479a55fd1d3104d35441ad
- SSDEEP
  
  24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJti1:WIwgMEuy+inDfp3/XoCw57XYBwK1
Score

10^/10

gh0strat purplefox discovery persistence rat rootkit trojan upx vmprotect
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Purplefox family
  purplefox
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2