gh0strat

General

Target

250210-b2bg4aynbz_pw_infected.zip
Size

1.2MB
Sample

250211-xjp4esxnaj
MD5

ad63686a82a6abde1bc66cd607b38caf
SHA1

697ecbee35395a0b670d8f8d485780f31cfd90fa
SHA256

183b6dbdf3e274ab79eab06e6cfa3500f173dd53f8e2aedc889ab1751b66ce45
SHA512

79f6eb1ab1ff969edcc374d76efb9da554e72e35fd83d0317c392b6aeb02460c25f2eb8d544a2804b56d3cc7eec8a17bcc243229af6fd7dbd2eff50c58936c73
SSDEEP

24576:oCKoooX84qwSEGIPjFTLmq/pX/7dv1Y7DwNXTNfOdlPI/:9Koj84KIP1p5v1Y7cNXTZO7w/

Score

10^/10

Malware Config

Targets

- Target
  
  250210-b2bg4aynbz_pw_infected.zip
- Size
  
  1.2MB
- MD5
  
  ad63686a82a6abde1bc66cd607b38caf
- SHA1
  
  697ecbee35395a0b670d8f8d485780f31cfd90fa
- SHA256
  
  183b6dbdf3e274ab79eab06e6cfa3500f173dd53f8e2aedc889ab1751b66ce45
- SHA512
  
  79f6eb1ab1ff969edcc374d76efb9da554e72e35fd83d0317c392b6aeb02460c25f2eb8d544a2804b56d3cc7eec8a17bcc243229af6fd7dbd2eff50c58936c73
- SSDEEP
  
  24576:oCKoooX84qwSEGIPjFTLmq/pX/7dv1Y7DwNXTNfOdlPI/:9Koj84KIP1p5v1Y7cNXTZO7w/
Score

10^/10

gh0strat purplefox discovery persistence rat rootkit trojan upx vmprotect
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Purplefox family
  purplefox
- Downloads MZ/PE file
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  persistence
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1