gh0strat | c7ab06e0578886f167c095a53cfaf9aece5d67a140b9baff0c9f128c64890f3f

General

Target
2026-06-04_45cf3c07181d1c890a5cbd49cd1f1997_coinminer_elex_emotet_glassworm_hijackloader_icedid_luca-stealer_njrat_poet-rat_quasar-rat_remcos_wannacry
Size 9.8MB
Sample260604-1fvraagv4j
SHA256 c7ab06e0578886f167c095a53cfaf9aece5d67a140b9baff0c9f128c64890f3f
MD5 45cf3c07181d1c890a5cbd49cd1f1997
SHA1 8dc1a5cf23e182df3d6b298450c1ed0a9a9def8d
SHA512 b16aec3a1b873fd8a64cde350ab4d4b25da24ad2f290bd56bbdc909084d36625230e1168edf7e88030500fb19cdca7fc147bb673ef21f4416490dfff525a678f
SSDEEP 98304:Mws2ANnKXOaeOgmhIguiRoW3kST9lgfU9PfCvRfj3Ml27OuKr+gvhf2:aKXbeO7ugNRouk49ifgCpfDvOuK6m
TLSH
T158A66C117BD48A23D29E5371C9B155625BB0BC19E3F297AB354C3DD93C32380BE2626B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-04_45cf3c07181d1c890a5cbd49cd1f1997_coinminer_elex_emotet_glassworm_hijackloader_icedid_luca-stealer_njrat_poet-rat_quasar-rat_remcos_wannacry
- Size 9.8MB
- SHA256 c7ab06e0578886f167c095a53cfaf9aece5d67a140b9baff0c9f128c64890f3f
- MD5 45cf3c07181d1c890a5cbd49cd1f1997
- SHA1 8dc1a5cf23e182df3d6b298450c1ed0a9a9def8d
- SHA512 b16aec3a1b873fd8a64cde350ab4d4b25da24ad2f290bd56bbdc909084d36625230e1168edf7e88030500fb19cdca7fc147bb673ef21f4416490dfff525a678f
- SSDEEP 98304:Mws2ANnKXOaeOgmhIguiRoW3kST9lgfU9PfCvRfj3Ml27OuKr+gvhf2:aKXbeO7ugNRouk49ifgCpfDvOuK6m
- TLSH
  T158A66C117BD48A23D29E5371C9B155625BB0BC19E3F297AB354C3DD93C32380BE2626B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution gh0strat purplefox xclient persistence rat rootkit spyware stealer trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Detect XClient Payload
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Family: PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Family: XClient
  XClient is a trojan written in C#.
  trojan xclient
- Gh0st RAT payload
- Detects executables containing base64 encoded User Agent
- Detects executables using Telegram Chat Bot
- UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2