gh0strat

Resubmissions

07-02-2025 07:57

250207-jtcn7atrht 10

07-02-2025 07:47

250207-jmvw7atqft 10

Sharing

Copy URL

Twitter E-mail

General

Target

f862416d44a913a6f4e7f155d087e4049d98027d354359073ef6d1eeda4ca0b2
Size

2.4MB
Sample

250207-jtcn7atrht
MD5

5d232aa81046c132a4a934749dd046ae
SHA1

03b6b668bf33bdc22a93d74d72bff9f461c86585
SHA256

f862416d44a913a6f4e7f155d087e4049d98027d354359073ef6d1eeda4ca0b2
SHA512

cf58d0f83362b48c3b49960c8de192cccb1f4d1cea9e9b1dc0f29d0146f66bac9f380650578a7dce45e7d3039e6c525a26ffae06b15d67b9f899c9e3cd71f66b
SSDEEP

24576:9CwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHH:9CwsbCANnKXferL7Vwe/Gg0P+WhTsSw

Score

10^/10

Malware Config

Targets

- Target
  
  f862416d44a913a6f4e7f155d087e4049d98027d354359073ef6d1eeda4ca0b2
- Size
  
  2.4MB
- MD5
  
  5d232aa81046c132a4a934749dd046ae
- SHA1
  
  03b6b668bf33bdc22a93d74d72bff9f461c86585
- SHA256
  
  f862416d44a913a6f4e7f155d087e4049d98027d354359073ef6d1eeda4ca0b2
- SHA512
  
  cf58d0f83362b48c3b49960c8de192cccb1f4d1cea9e9b1dc0f29d0146f66bac9f380650578a7dce45e7d3039e6c525a26ffae06b15d67b9f899c9e3cd71f66b
- SSDEEP
  
  24576:9CwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHH:9CwsbCANnKXferL7Vwe/Gg0P+WhTsSw
Score

10^/10

gh0strat purplefox discovery persistence rat rootkit trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Purplefox family
  purplefox
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Detect PurpleFox Rootkit

Gh0st RAT payload

Gh0strat family

PurpleFox

Purplefox family

Drops file in Drivers directory

Server Software Component: Terminal Services DLL

Sets service image path in registry

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9