General
- Target 2026-08-23_cfbf6638dc1221d988bbe18eae9eb02d_akira_amadey_elex_glassworm
- Size 134.1MB
- Sample260823-y7kpaaap71
- SHA256 7def92b5fb376ac6dce8d4124ca6681780aa8d045d3e83468a934e9ee009fc6a
Score
10/10
Malware Config
Targets
-
- Target 2026-08-23_cfbf6638dc1221d988bbe18eae9eb02d_akira_amadey_elex_glassworm
- Size 134.1MB
- SHA256 7def92b5fb376ac6dce8d4124ca6681780aa8d045d3e83468a934e9ee009fc6a
Score10/10-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Gh0st RAT payload
-
Detects executables calling ClearMyTracksByProcess
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Command and Scripting Interpreter: PowerShell
Start PowerShell.
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)
-
Suspicious use of SetThreadContext