gh0strat | 2026-05-18_e7291f77506112fd005d324943dab11b_elex_mimikatz_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-18_e7291f77506112fd005d324943dab11b_elex_mimikatz_wannacry
Size 1.2MB
Sample260518-t84rbshs21
SHA256 edb66b0473495ad632a4acb5523051b0f33a00eb33b5395f78a97c8af1e4430a
MD5 e7291f77506112fd005d324943dab11b
SHA1 cb7faf14ba1c7a6d71810f1faf5d2573e700045f
SHA512 79930b104c331af3780f1281d07bc7a9917914301475157555694274b54d9dcb2fb3307471d3e05b29b78d503ae1e826869adb297b1edd82068efbe524338be9
SSDEEP 24576:xueA2K4Nw7Y2EfMBs7iwbQ+pWaGM5WbUg/n3MtRFdTFpkTKZYkK0:/92GM0kTX
TLSH
T138454B83E6B64CB3CBD50430EC6EE2767B24791D93FB86737680D9D3B5662907C2025A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rootkit rat gh0strat trojan purplefox

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
sample	purplefox_rootkit

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-18_e7291f77506112fd005d324943dab11b_elex_mimikatz_wannacry

File Explorer

2026-05-18_e7291f77506112fd005d324943dab11b_elex_mimikatz_wannacry

.exe 1.2MB

2026-05-18_e7291f77506112fd005d324943dab11b_elex_mimikatz_wannacry

IMPHASH 163424b49628264450d567d54673e99a
SHA256 edb66b0473495ad632a4acb5523051b0f33a00eb33b5395f78a97c8af1e4430a
MD5 e7291f77506112fd005d324943dab11b
SHA1 cb7faf14ba1c7a6d71810f1faf5d2573e700045f
SHA512 79930b104c331af3780f1281d07bc7a9917914301475157555694274b54d9dcb2fb3307471d3e05b29b78d503ae1e826869adb297b1edd82068efbe524338be9
SSDEEP 24576:xueA2K4Nw7Y2EfMBs7iwbQ+pWaGM5WbUg/n3MtRFdTFpkTKZYkK0:/92GM0kTX
TLSH
T138454B83E6B64CB3CBD50430EC6EE2767B24791D93FB86737680D9D3B5662907C2025A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect PurpleFox Rootkit

Detect PurpleFox Rootkit.

rootkit
Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

185041

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileAttributesExA CreateToolhelp32Snapshot Process32Next Process32First ExitProcess DeviceIoControl MoveFileExA CopyFileA GetModuleFileNameA GetVersionExA TerminateProcess OpenProcess TerminateThread GetTickCount GetCommandLineA FreeConsole GetCurrentProcessId GetConsoleProcessList AttachConsole GetWindowsDirectoryA GlobalSize QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryW GlobalMemoryStatusEx GetSystemInfo ReleaseMutex CreateMutexA GetCurrentThread GetEnvironmentVariableA FileTimeToSystemTime GetCurrentThreadId MultiByteToWideChar WideCharToMultiByte lstrcpyW WinExec Module32Next lstrcmpiA Module32First CreateRemoteThread GetProcessId ResumeThread OpenThread Thread32Next Thread32First SuspendThread GetPriorityClass GlobalMemoryStatus GetComputerNameA GetPrivateProfileStringA SystemTimeToTzSpecificLocalTime lstrcpynA lstrcmpA UnmapViewOfFile FlushViewOfFile MapViewOfFile CreateFileMappingA GetFileSizeEx GetTempPathA GetStartupInfoA MoveFileA SetFileAttributesA RemoveDirectoryA FindFirstFileA FindNextFileA FindClose GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA lstrcatA CreateProcessA lstrcpyA GetProcAddress CreateDirectoryA GetLastError DeleteFileA GetCurrentProcess IsWow64Process SetFilePointer WriteFile LocalSize GetSystemDirectoryA GetFileAttributesA CreateFileA GetFileSize ReadFile lstrlenA LocalReAlloc LocalAlloc LocalFree FreeLibrary IsBadReadPtr VirtualProtect HeapReAlloc HeapAlloc GetProcessHeap HeapFree Sleep CancelIo SetEvent ResetEvent CreateEventA GetModuleHandleA GetLocalTime GlobalAlloc GlobalLock GlobalFree GlobalUnlock CreateThread VirtualAlloc EnterCriticalSection LeaveCriticalSection VirtualFree DeleteCriticalSection InitializeCriticalSection InterlockedExchange WaitForSingleObject CloseHandle LoadLibraryA FlushFileBuffers

user32

MessageBoxA CharNextA GetWindowTextA GetForegroundWindow GetAsyncKeyState GetKeyState EnumWindows ExitWindowsEx ChangeDisplaySettingsA GetSystemMetrics GetDC LoadCursorA DestroyCursor BlockInput ReleaseDC SystemParametersInfoA wsprintfA MapVirtualKeyA mouse_event CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetClipboardData GetCursorInfo GetCursorPos GetLastInputInfo DefWindowProcA CreateWindowExA RegisterClassExA FindWindowA WaitForInputIdle SetThreadDesktop PostMessageA IsWindowVisible GetWindowThreadProcessId SendMessageA DispatchMessageA TranslateMessage IsDialogMessageA ShowWindow GetWindowLongA PostQuitMessage SetWindowLongA LoadIconA SetClassLongA DestroyWindow GetDlgItemTextA SetFocus GetWindowTextLengthA SetWindowTextA SetDlgItemTextA CreateDialogIndirectParamA GetDlgItem SetWindowPos GetMessageA GetUserObjectInformationA GetThreadDesktop CloseDesktop OpenInputDesktop keybd_event

gdi32

CreateCompatibleBitmap GetDIBits CreateRectRgnIndirect CombineRgn GetRegionData BitBlt DeleteDC DeleteObject CreateCompatibleDC GetDeviceCaps SelectObject CreateDIBSection

advapi32

LockServiceDatabase GetTokenInformation LookupAccountSidA AbortSystemShutdownA RegOpenKeyA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges EnumServicesStatusA QueryServiceConfigA QueryServiceConfig2A QueryServiceStatus ControlService RegCloseKey RegOpenKeyExA GetUserNameA CloseEventLog ClearEventLogA OpenEventLogA RegSetValueExA RegCreateKeyA StartServiceA CloseServiceHandle OpenServiceA OpenSCManagerA SetServiceStatus DeleteService SetSecurityDescriptorDacl InitializeSecurityDescriptor RegEnumValueA RegEnumKeyExA RegQueryValueExA RegDeleteValueA RegDeleteKeyA RegQueryInfoKeyA RegCreateKeyExA UnlockServiceDatabase ChangeServiceConfigA

shell32

SHFileOperationA ShellExecuteA ShellExecuteExA SHGetSpecialFolderPathA SHGetFileInfoA SHGetFolderPathA

ole32

CoInitialize CoCreateInstance CoUninitialize

oleaut32

SysFreeString

mfc42

ord5450 ord6383 ord5440 ord940 ord6283 ord2784 ord4129 ord6662 ord4278 ord2763 ord6282 ord5710 ord535 ord536 ord939 ord6876 ord3663 ord2818 ord6143 ord354 ord5186 ord665 ord4204 ord2915 ord5442 ord5572 ord6874 ord2764 ord1979 ord356 ord858 ord537 ord922 ord2770 ord2781 ord4058 ord3178 ord1980 ord4215 ord3324 ord3310 ord3010 ord3304 ord3181 ord941 ord6883 ord668 ord2614 ord860 ord3811 ord800 ord541 ord540 ord801 ord825 ord823 ord6394

msvcrt

strncat realloc strncpy atol atoi _errno mbstowcs wcstombs _snprintf _vsnprintf fread fclose fopen fwrite ftell fseek _splitpath time ??1type_info@@UAE@XZ __dllonexit _onexit _exit _XcptFilter exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp swprintf rand strncmp strchr wcsstr _stricmp _except_handler3 strrchr srand _strlwr _wcsupr _strcmpi _strnicmp fprintf sscanf getenv vsprintf _CxxThrowException sprintf __CxxFrameHandler memmove ceil _ftol strstr wcslen wcscpy _iob free malloc

msvcp60

??1_Lockit@std@@QAE@XZ ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ??0_Lockit@std@@QAE@XZ

winmm

waveInGetNumDevs

ws2_32

recvfrom sendto listen accept getpeername bind getsockname __WSAFDIsSet gethostname ntohs inet_ntoa send closesocket recv select socket connect inet_addr WSAStartup WSACleanup WSAIoctl setsockopt htons gethostbyname

iphlpapi

GetIfTable

shlwapi

PathGetArgsA PathRemoveArgsA PathUnquoteSpacesA SHDeleteKeyA PathFindFileNameA

netapi32

NetUserAdd NetUserGetLocalGroups NetApiBufferFree NetUserGetInfo NetUserDel NetUserSetInfo NetLocalGroupAddMembers NetUserEnum

psapi

GetProcessMemoryInfo GetModuleFileNameExA

wininet

InternetGetConnectedState DeleteUrlCacheEntry

wtsapi32

WTSEnumerateSessionsA WTSQuerySessionInformationW WTSDisconnectSession WTSLogoffSession WTSQuerySessionInformationA WTSFreeMemory

Name

.text

Size

592KB

Virtual Size

590KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rotext

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

268KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

196KB

Virtual Size

628KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=1, id=49, version=9044,

count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=58, id=48, version=9044,

count=78, productName=Unmarked objects (old),

count=1, id=11, version=8047,

count=6, id=14, version=7299,

count=11, id=10, version=8047,

count=4, id=4, version=8047,

count=5, id=12, version=7291,

count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=2, id=4, version=9782,

count=3, id=95, version=2190,

count=31, id=93, version=2179,

count=450, id=1, productName=Unmarked objects,

count=32, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=12, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=2, id=42, version=8803,

count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,