General
-
Target
2025-04-02_b8011778039c766a9c0b06c4f9e90212_frostygoop_gcleaner_poet-rat_sliver_snatch
-
Size
30.4MB
-
Sample
250402-axxdbsx1ew
-
MD5
b8011778039c766a9c0b06c4f9e90212
-
SHA1
f223edc9b2006f69673768e1d7e0a429f9c91b8d
-
SHA256
39243396378dc3cb8518cc7066078542a78a41d9c364dcf13a6dd31755aff025
-
SHA512
0294aca91e79df8da569d887c426a17d17ebe6a785d1d2f0daf6aede9cf74c3a5905ff03b6a03f320a0e7902d0a67c4787a4528c7fcf1c9681d121ac2bfd2bf2
-
SSDEEP
393216:cj6Fuy2Eko3SfP7ewAArcVbiYZN/NzTNIOvh1UR8ChT4JSb6y43wjYPz95vO:cmD3UDAL5Rh1at+yUDP3m
Malware Config
Targets
-
-
Target
2025-04-02_b8011778039c766a9c0b06c4f9e90212_frostygoop_gcleaner_poet-rat_sliver_snatch
-
Size
30.4MB
-
MD5
b8011778039c766a9c0b06c4f9e90212
-
SHA1
f223edc9b2006f69673768e1d7e0a429f9c91b8d
-
SHA256
39243396378dc3cb8518cc7066078542a78a41d9c364dcf13a6dd31755aff025
-
SHA512
0294aca91e79df8da569d887c426a17d17ebe6a785d1d2f0daf6aede9cf74c3a5905ff03b6a03f320a0e7902d0a67c4787a4528c7fcf1c9681d121ac2bfd2bf2
-
SSDEEP
393216:cj6Fuy2Eko3SfP7ewAArcVbiYZN/NzTNIOvh1UR8ChT4JSb6y43wjYPz95vO:cmD3UDAL5Rh1at+yUDP3m
Score10/10-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Purplefox family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-