gh0strat

General

Target

0ef592eb7617d71201c49b0efb4d00fcaf784d3320e58eb79fea0cd8963f5df6
Size

1.2MB
Sample

250402-x1cjnavmt3
MD5

6c32cddfc88a5e47431fae6bcaf37e57
SHA1

275eee69ff410f0944a6074dcc5a112ecf8622e0
SHA256

0ef592eb7617d71201c49b0efb4d00fcaf784d3320e58eb79fea0cd8963f5df6
SHA512

eea143e5a36c65fc5b89a34666827cc6df91998d900f6bd0c934a8043b220c7fc93d935a1a7b0bd9c79aa91d39894cf89653c2c9b1544f6b91ee86acb04ec5a7
SSDEEP

24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJti0:WIwgMEuy+inDfp3/XoCw57XYBwK0

Score

10^/10

Malware Config

Targets

- Target
  
  0ef592eb7617d71201c49b0efb4d00fcaf784d3320e58eb79fea0cd8963f5df6
- Size
  
  1.2MB
- MD5
  
  6c32cddfc88a5e47431fae6bcaf37e57
- SHA1
  
  275eee69ff410f0944a6074dcc5a112ecf8622e0
- SHA256
  
  0ef592eb7617d71201c49b0efb4d00fcaf784d3320e58eb79fea0cd8963f5df6
- SHA512
  
  eea143e5a36c65fc5b89a34666827cc6df91998d900f6bd0c934a8043b220c7fc93d935a1a7b0bd9c79aa91d39894cf89653c2c9b1544f6b91ee86acb04ec5a7
- SSDEEP
  
  24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJti0:WIwgMEuy+inDfp3/XoCw57XYBwK0
Score

10^/10

gh0strat purplefox discovery persistence rat rootkit trojan upx vmprotect
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Purplefox family
  purplefox
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1