gh0strat | 31f351dfc2445357b7cf22cdc6d7de740d579eb4a4359045500c9bb0a784f001

General

Target
2026-07-27_dda137f35053e6b305bb8c70c614b61a_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_rhadamanthys_smoke-loader_stop_wannacry
Size 11.0MB
Sample260727-jpfv2sysfv
SHA256 31f351dfc2445357b7cf22cdc6d7de740d579eb4a4359045500c9bb0a784f001
MD5 dda137f35053e6b305bb8c70c614b61a
SHA1 2877e8c1a977557fc02d76e52cb3e770fa82865b
SHA512 8de52183dbc046efc12748350b9f592c7556ad0556794c9d5088ce573a4b36a82b50ffb492f18718e0135d9c206d1d62e3cbba92f974fd5c0e96241ce37b4781
SSDEEP 196608:aKXbeO7kBipoLcGSWLx4tKryqlumqvX64:H7kB8okWLatWyvX64
TLSH
T1E4C6D013B1828073D2911970CD679AB26B357E7A1BF289A777D4FED83E313907A31216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  2026-07-27_dda137f35053e6b305bb8c70c614b61a_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_icedid_remcos_rhadamanthys_smoke-loader_stop_wannacry
- Size 11.0MB
- SHA256 31f351dfc2445357b7cf22cdc6d7de740d579eb4a4359045500c9bb0a784f001
- MD5 dda137f35053e6b305bb8c70c614b61a
- SHA1 2877e8c1a977557fc02d76e52cb3e770fa82865b
- SHA512 8de52183dbc046efc12748350b9f592c7556ad0556794c9d5088ce573a4b36a82b50ffb492f18718e0135d9c206d1d62e3cbba92f974fd5c0e96241ce37b4781
- SSDEEP 196608:aKXbeO7kBipoLcGSWLx4tKryqlumqvX64:H7kB8okWLatWyvX64
- TLSH
  T1E4C6D013B1828073D2911970CD679AB26B357E7A1BF289A777D4FED83E313907A31216
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution gh0strat purplefox persistence rat rootkit trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Family: PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Gh0st RAT payload
- UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2