gh0strat | 5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
Size 2.1MB
Sample260423-e5z7eagz6j
SHA256 5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d
MD5 c52e3bdead5afc614a1127f3b06e62c5
SHA1 aab7067856971f7e803393b90832762d4bdec561
SHA512 0b5fdd5837f25f1473c7ef6a8d8c7bee147897d6e443c20a9d9208fed06dc36538d21aec3ea4325c996b929eb4803d0f6056d805c6fa2ae95699e819ad3efdab
SSDEEP 49152:w09XJt4HIN2H2tFvduyS5LYZg81oHuRTF:1ZJt4HINy2Lk/SoHEF
TLSH
T115A5AE02B1A140BFC655103C49AA9775AA75EE316A26CE83F3D4FD3F7C33151A93622B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Detect PurpleFox Rootkit 7 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/1500-8-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1500-9-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3644-18-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3644-19-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1736-31-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1736-35-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1736-36-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/1500-8-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1500-9-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3644-18-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3644-19-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1736-31-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1736-35-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1736-36-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Executes dropped EXE 4 IoCs

pid	Process
1500	RVN.exe
3644	TXPlatforn.exe
2820	HD_5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
1736	TXPlatforn.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1500-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1500-8-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1500-9-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3644-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3644-18-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3644-19-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1736-31-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1736-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1736-36-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RVN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatforn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2884	cmd.exe
4364	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4364	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4340	5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
4340	5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1736	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1500	RVN.exe
Token: SeLoadDriverPrivilege	1736	TXPlatforn.exe
Token: 33	1736	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	1736	TXPlatforn.exe
Token: 33	1736	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	1736	TXPlatforn.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2820	HD_5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
2820	HD_5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
2820	HD_5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2820	HD_5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
2820	HD_5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
2820	HD_5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4340	5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
4340	5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
2820	HD_5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
2820	HD_5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 1500	4340	5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe	80
PID 1500 wrote to memory of 2884	1500	RVN.exe	82
PID 4340 wrote to memory of 2820	4340	5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe	83
PID 3644 wrote to memory of 1736	3644	TXPlatforn.exe	84
PID 2884 wrote to memory of 4364	2884	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
"C:\Users\Admin\AppData\Local\Temp\5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Users\Admin\AppData\Local\Temp\RVN.exe
  C:\Users\Admin\AppData\Local\Temp\\RVN.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4364
- C:\Users\Admin\AppData\Local\Temp\HD_5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
  C:\Users\Admin\AppData\Local\Temp\HD_5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2820

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Windows\SysWOW64\TXPlatforn.exe
  C:\Windows\SysWOW64\TXPlatforn.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vlc.exe

Path C:\Program Files\VideoLAN\VLC\vlc.exe
Size 2.1MB
SHA256 5ab9fac138f06e50284c93af64b9f37fc0af5bb66b7deae9fbade3264a9f4b00
MD5 322f5a0a8193e7e8cf0260cc7503999e
SHA1 cc8c243ad34ff02db6bf4d31966e2eaf49df690f
SHA512 559f26a3f3d6595d63699a0b52a7d52b53fdc1043499e4cb1b69ce24b79ddccd0b8ccd2162ab25ef6df3093d89ef9f99d514f07f4a32597faef7f82ef547648b
SSDEEP 49152:E09XJt4HIN2H2tFvduySCKLsxAibBEZ1LWtBzkOm:pZJt4HINy2LkyZOAC
TLSH
T186A5AF17E6A284F9C51AC03087A7D772AA307D194625AE6F5BD4DF273E30950EB3E324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe

Path C:\Users\Admin\AppData\Local\Temp\HD_5d35c01ac0b41bd0457e2d6f2578a91fb6ed16df8e7b756433e3358785abce8d.exe
Size 1.0MB
SHA256 b89f7223b50294f65e008dbb676c283cb5d849ce709a9bfd6cf9b60672756539
MD5 bf5f77baf61d1d8410f9ac95ec15c51b
SHA1 a1e7947e9e02690043aab4d47f549ea6ff51ac67
SHA512 5f7417135f3221be2cfc92e6a121b0ef62214aa7031c1393408c233b0d2b0d6a8ab52924e8eed44212516811d7b3d46f17821d26acff32db5ab754aec9e8fa14
SSDEEP 12288:Ja9vw4BOrmoQW3UGWvo7ZcC4/dgeizICQGjQvz8rR7Jmgy7W7WMEIqnu+ujVTOgp:JHiOrZQUL85r8rR7UW1+u+ujVTOgf
TLSH
T1AF255A06B2B140BFC665003C09AA9771B634E9357625DE83F3D5FE3EB937452982622F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HD_X.dat

Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
Size 1.2MB
SHA256 b8ee768e8ad2c8a3ff2ba3780e71b7560343b6d8273109b5defdb2ccf71b00fa
MD5 9834dd1a944b1054f30489f09e597a76
SHA1 9cf5d23c74e688ffc32481965c6a0a5274f77849
SHA512 e9d873dab1695f5f3105bdeef288850c44099a7d86a67529e8750b5aaee7948243fa9172140927739388730096e248560556e236701a3d474d9836ead061d04a
SSDEEP 24576:Y09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+/JoLm:Y09XJt4HIN2H2tFvduySfoLm
TLSH
T1BB45C053F982C4F1C604643048AEE7B6DAB65F414B228A87D7D4FD2F3DB2151B63A13A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RVN.exe

Path C:\Users\Admin\AppData\Local\Temp\RVN.exe
Size 377KB
SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
MD5 80ade1893dec9cab7f2e63538a464fcc
SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
SSDEEP 6144:BEo7J1ixs4uVKE9rFEAHKThrBSq2hAzSM5mDo9lSJULHZqExlD2E1LxhJVwIe0Dy:Wo2HQVWAHkFSq2hAWJYlMUtrxlyuJVRq
TLSH
T13A841221EB1265A2D30BB0F0CE685F0688B953584C6D1D57EEB51E2D7D3A3EDE832D06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaitEdit.exe

Path C:\Users\Admin\Desktop\WaitEdit.exe
Size 2.1MB
SHA256 c33ef38bd7ae384f947d2398c2447f410f0bcda85104d69880ae8ee5987888cd
MD5 157cebb9b4d99a7c0a25f2e0e6ec0efa
SHA1 78581d2af1b4693c8bdd8d41aa702eb8dc1498d9
SHA512 e88b557a520b3eb3c6d45260c8806bf164cf2d4aa53473edeb2648dfdfda37576d8583791c30990a7de94169955420f69b9e74464b8cabf0830f4ae9df79692b
SSDEEP 49152:w09XJt4HIN2H2tFvduyS5LAaRlOE0pQ2h9UhX:1ZJt4HINy2Lk27HPc
TLSH
T156A50253F592C4F1C6046430486EEB76EAB65F428B228A83D7D4FD5F7CB2141B63A13A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1500-8-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1500-6-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1500-12-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1500-9-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1736-31-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1736-36-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/1736-35-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3644-18-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3644-19-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/3644-30-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3644-17-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3644-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Download

memory/4340-0-0x0000000000400000-0x0000000000541000-memory.dmp

Download

memory/4340-1-0x0000000000480000-0x0000000000481000-memory.dmp

Download

memory/4340-108-0x0000000000400000-0x0000000000541000-memory.dmp

Download