gh0strat | e2b2013166a4683bf8f0e455a31dd7d85216bce7ded4988f36049d2e0f6f302e

General

Target
e2b2013166a4683bf8f0e455a31dd7d85216bce7ded4988f36049d2e0f6f302e
Size 1.6MB
Sample260530-2eejcaet4t
SHA256 e2b2013166a4683bf8f0e455a31dd7d85216bce7ded4988f36049d2e0f6f302e
MD5 1b8549a1792119028ba9573cc11f7bf7
SHA1 a2cde5f512e269728019c9bd3f3a77c83aa0e521
SHA512 ea96311f68d05e3ff9ce60f8f7b5b39bb8e52bac2bdf626f601484e28b2c412615c57f52e1de87551c92276b9c881297740a4b1e9143c002b292e922034c2cdb
SSDEEP 24576:z4rDuOIlp7ePLgRyU7CKiFgS8LPfL0jUkM5FIJRweiMtRMqYCTeCK0n:I9oXU3
TLSH
T107755C43E2B28CE7C7D90534DC6AD2767B347A1C93FB86737680D9D7B5622907A2031A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rootkit upx rat gh0strat trojan purplefox

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
sample	purplefox_rootkit

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e2b2013166a4683bf8f0e455a31dd7d85216bce7ded4988f36049d2e0f6f302e

File Explorer

e2b2013166a4683bf8f0e455a31dd7d85216bce7ded4988f36049d2e0f6f302e

.dll 1.6MB

e2b2013166a4683bf8f0e455a31dd7d85216bce7ded4988f36049d2e0f6f302e

SHA256 e2b2013166a4683bf8f0e455a31dd7d85216bce7ded4988f36049d2e0f6f302e
MD5 1b8549a1792119028ba9573cc11f7bf7
SHA1 a2cde5f512e269728019c9bd3f3a77c83aa0e521
SHA512 ea96311f68d05e3ff9ce60f8f7b5b39bb8e52bac2bdf626f601484e28b2c412615c57f52e1de87551c92276b9c881297740a4b1e9143c002b292e922034c2cdb
SSDEEP 24576:z4rDuOIlp7ePLgRyU7CKiFgS8LPfL0jUkM5FIJRweiMtRMqYCTeCK0n:I9oXU3
TLSH
T107755C43E2B28CE7C7D90534DC6AD2767B347A1C93FB86737680D9D7B5622907A2031A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect PurpleFox Rootkit

Detect PurpleFox Rootkit.

rootkit
Gh0st RAT payload
ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1789008

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

generic

count=1, id=49, version=9044,

count=58, id=48, version=9044,

count=75, productName=Unmarked objects (old),

count=4, id=12, version=7291,

count=10, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=34, id=14, version=7299,

count=137, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=3, id=11, version=8047,

count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=31, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=345, id=1, productName=Unmarked objects,

count=13, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=29, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=2, id=18, version=8444,

count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,

Sharing