gh0strat | 18d689010c45da23e6ae611152ed950ae3a60aa4223d5a710cacf468309eb277

General

Target
2026-08-07_2518ac26af20a37d45f289d393bd12e6_amadey_darkgate_elex_emotet_glassworm_icedid_remcos_smoke-loader_wannacry
Size 9.0MB
Sample260807-3ep6hsae27
SHA256 18d689010c45da23e6ae611152ed950ae3a60aa4223d5a710cacf468309eb277
MD5 2518ac26af20a37d45f289d393bd12e6
SHA1 b1c69bfa088fd27dd125eda4d1bb88d22db5df44
SHA512 f022d92373b0192e34697e4ab70ec908e123a3cbabde540e8c4b385347adfa633e214c4b22e3f6780db9dbbeef2628ee2cf070fd055c8c311d0ec33d9e893692
SSDEEP 196608:oKXbeO7h1nDIMX/W2SuE2JBgUPGvcbpotQgAzh5DYOGO7O8Oj8h:R7h1N/sqU5ce6gU
TLSH
T10D96DF0370428061C2C50EB2DEA6DA725BF5FA691BF789B3F694EFC579301A17A37205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-07_2518ac26af20a37d45f289d393bd12e6_amadey_darkgate_elex_emotet_glassworm_icedid_remcos_smoke-loader_wannacry
- Size 9.0MB
- SHA256 18d689010c45da23e6ae611152ed950ae3a60aa4223d5a710cacf468309eb277
- MD5 2518ac26af20a37d45f289d393bd12e6
- SHA1 b1c69bfa088fd27dd125eda4d1bb88d22db5df44
- SHA512 f022d92373b0192e34697e4ab70ec908e123a3cbabde540e8c4b385347adfa633e214c4b22e3f6780db9dbbeef2628ee2cf070fd055c8c311d0ec33d9e893692
- SSDEEP 196608:oKXbeO7h1nDIMX/W2SuE2JBgUPGvcbpotQgAzh5DYOGO7O8Oj8h:R7h1N/sqU5ce6gU
- TLSH
  T10D96DF0370428061C2C50EB2DEA6DA725BF5FA691BF789B3F694EFC579301A17A37205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution gh0strat purplefox persistence rat rootkit spyware stealer trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Family: PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Gh0st RAT payload
- UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2