gh0strat | df4bfa72aa1f4dd300d4a3acc766f311a745520ba083fae05d6b58b59aa094aa[.]dll

General

Target
df4bfa72aa1f4dd300d4a3acc766f311a745520ba083fae05d6b58b59aa094aa.dll
Size 1.6MB
Sample260507-ht87qagy21
SHA256 df4bfa72aa1f4dd300d4a3acc766f311a745520ba083fae05d6b58b59aa094aa
MD5 b002a4f5944c596d9d16bc0f45093eca
SHA1 4d277b97791666538ec12e4ca99665a7e79c9509
SHA512 41a8412ca6bdab0395168e727e5041b9ef8b7604116c2d21b7fa6b28592816c1628a28c83b6590835645358e6d0b45fd2b202b35f5161f7dda45563f7c5e1661
SSDEEP 24576:FIAbi4MwB6LJPdAtyU7iiidwCsLzPLLjUJM5FIJRweiMtRMqYCT+5K08:iNEXKR
TLSH
T109755C43E2B28CE7C7D90531DC6AD2767B347A1C93FB86737680D9D7B5622907A2031A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rootkit upx rat gh0strat trojan purplefox

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
sample	purplefox_rootkit

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df4bfa72aa1f4dd300d4a3acc766f311a745520ba083fae05d6b58b59aa094aa.dll

File Explorer

df4bfa72aa1f4dd300d4a3acc766f311a745520ba083fae05d6b58b59aa094aa.dll

.dll 1.6MB

df4bfa72aa1f4dd300d4a3acc766f311a745520ba083fae05d6b58b59aa094aa.dll

SHA256 df4bfa72aa1f4dd300d4a3acc766f311a745520ba083fae05d6b58b59aa094aa
MD5 b002a4f5944c596d9d16bc0f45093eca
SHA1 4d277b97791666538ec12e4ca99665a7e79c9509
SHA512 41a8412ca6bdab0395168e727e5041b9ef8b7604116c2d21b7fa6b28592816c1628a28c83b6590835645358e6d0b45fd2b202b35f5161f7dda45563f7c5e1661
SSDEEP 24576:FIAbi4MwB6LJPdAtyU7iiidwCsLzPLLjUJM5FIJRweiMtRMqYCT+5K08:iNEXKR
TLSH
T109755C43E2B28CE7C7D90531DC6AD2767B347A1C93FB86737680D9D7B5622907A2031A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect PurpleFox Rootkit

Detect PurpleFox Rootkit.

rootkit
Gh0st RAT payload
ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1789008

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

generic

count=1, id=49, version=9044,

count=58, id=48, version=9044,

count=75, productName=Unmarked objects (old),

count=4, id=12, version=7291,

count=10, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=34, id=14, version=7299,

count=137, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=3, id=11, version=8047,

count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=31, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=345, id=1, productName=Unmarked objects,

count=13, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=29, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=2, id=18, version=8444,

count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,

Sharing