Extracted

Extracted

• • Target
    2026-06-04_714f2b94be5a67ceac6e6e3eb74b047d_elex_emotet_remcos_wannacry
  • Size 4.5MB
  • SHA256 cfe506dd487d4b970d4199a4b8759c5e5479d40c3a38ed65205ea5916a48ead3
  • MD5 714f2b94be5a67ceac6e6e3eb74b047d
  • SHA1 b080f6132ddf7d07b8b7bd083d2908395d2db1a9
  • SHA512 ea10c6b41d3009bc5ba757c15cee2b18005f269c1005c1bd3e8d624e09195534813fe6748f8aa346f19a96054d0dff5bea92df37e6e097324d512edb296d2dfc
  • SSDEEP 98304:aws2ANnKXOaeOgmhZqK6guGJ3XTucPqdhA:wKXbeO7bB6gFJnTu0sh
  • TLSH
    T15C26D043B5524472C3C84A72DE67D9B39B217EBE1BF30636BA5CFEC43A352447A21225
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutioncrytoxgh0stratpurplefoximpactpersistenceransomwareratrootkitstealertrojanupx

  • Detect PurpleFox Rootkit

    Detect PurpleFox Rootkit.

    rootkit

  • Family: Crytox

    Crytox is a ransomware that has been active since 2020.

    ransomwarecrytox

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Family: PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox

  • Gh0st RAT payload

  • Clears Windows event logs

    defense_evasionransomware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (14216) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Custom signature

    UPX dump on OEP (original entry point)

  • Drops file in Drivers directory

  • Server Software Component: Terminal Services DLL

    persistence

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2