Extracted

Extracted

• • Target
    2026-06-04_584d863f42bd816d75a0df793aced404_diavol_elex_emotet_icedid_remcos_wannacry
  • Size 3.4MB
  • SHA256 7c0bb8889cddc6dd81e94c5c9c343e2e8f9982d54d371b5375b5b5337fbff41c
  • MD5 584d863f42bd816d75a0df793aced404
  • SHA1 7db8d104fd0decc1fa3af6432e25b9245a0df2c2
  • SHA512 be80bac84a58307a266c89ab350bc2ec91e1024118ed3c08a65c4d07f4c6ba8833f17ccf396a720077c5f39b7e2201907f03cb9ce57b3e8ea19f14708a7b6794
  • SSDEEP 49152:PCwsbCANnKXferL7Vwe/Gg0P+Wh5D2y9WZ1tc6gu7W:aws2ANnKXOaeOgmhZqK6gu7
  • TLSH
    T145F5AE43B5960472C3C84A72DE67D9B39B217E7E17F30236BA58FED43B352447A22225
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondiavolgh0stratpurplefoximpactpersistenceransomwareratrootkitspywarestealertrojanupx

  • Detect PurpleFox Rootkit

    Detect PurpleFox Rootkit.

    rootkit

  • Family: Diavol

    Diavol is a ransomware that has been active since 2021.

    ransomwarediavol

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Family: PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox

  • Gh0st RAT payload

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Detects executables containing many references to VEEAM. Observed in ransomware

  • Detects ransomware indicator

  • UPX dump on OEP (original entry point)

  • Drops file in Drivers directory

  • Server Software Component: Terminal Services DLL

    persistence

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2