gh0strat | 8339822ff549a3106f06b3246f22b150df3cccb48d443f561434ca75cd71928e

General

Target
2026-06-04_25feea8c81e3a25cb1b01c4e389c1af6_cobalt-strike_elex_emotet_glassworm_hive_icedid_luca-stealer_remcos_wannacry
Size 6.8MB
Sample260604-1ddd8afy5s
SHA256 8339822ff549a3106f06b3246f22b150df3cccb48d443f561434ca75cd71928e
MD5 25feea8c81e3a25cb1b01c4e389c1af6
SHA1 f7978026835b1bad675f8fef2b02408c9272f75b
SHA512 e3db430af2a93e43079186cdf903c75106b2bcfc0746e653cb82d57cf6b6864d3e4403f8a9760eb05b47f1ca53e7d596384f291f43209e0d05242eba79687d5f
SSDEEP 98304:Mws2ANnKXOaeOgmhIgu6eF+iIAEl1JPz212IhzL+Bzz3dw/Vc:aKXbeO7ugyWvSDzaxztQVc
TLSH
T1CA767B03B89514A5C6D9A231CD6686B27B317C6907F213E73A64BEFA3A367C43E35350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-04_25feea8c81e3a25cb1b01c4e389c1af6_cobalt-strike_elex_emotet_glassworm_hive_icedid_luca-stealer_remcos_wannacry
- Size 6.8MB
- SHA256 8339822ff549a3106f06b3246f22b150df3cccb48d443f561434ca75cd71928e
- MD5 25feea8c81e3a25cb1b01c4e389c1af6
- SHA1 f7978026835b1bad675f8fef2b02408c9272f75b
- SHA512 e3db430af2a93e43079186cdf903c75106b2bcfc0746e653cb82d57cf6b6864d3e4403f8a9760eb05b47f1ca53e7d596384f291f43209e0d05242eba79687d5f
- SSDEEP 98304:Mws2ANnKXOaeOgmhIgu6eF+iIAEl1JPz212IhzL+Bzz3dw/Vc:aKXbeO7ugyWvSDzaxztQVc
- TLSH
  T1CA767B03B89514A5C6D9A231CD6686B27B317C6907F213E73A64BEFA3A367C43E35350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery gh0strat gofing purplefox persistence ransomware rat rootkit spyware stealer trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Family: Gofing
  Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
  ransomware gofing
- Family: PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Gh0st RAT payload
- Gofing is a ransomware written in Golang using Velocity Polymorphic Compression (VPC) obfuscation.
- Renames multiple (55) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Custom signature
  
  UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2