gh0strat | 54eb08b2941c0ca61409d1cae86d2e918684f1f5e3a1091817601652560c3cc2

General

Target
2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar
Size 106.0MB
Sample260824-varjsa1bpg
SHA256 54eb08b2941c0ca61409d1cae86d2e918684f1f5e3a1091817601652560c3cc2
MD5 14ae4de065de6bfc376d12469ba4077a
SHA1 fced4987cb78c96b22a8d195a72e6bff358ac51c
SHA512 6c604b9db62630cf20b58492b01b9f5e658f9c91e09fcc76b8b7eb1548bab83e75fc881242e2b18db56c350cdef848420468f62d4cdc570a60cb50f1e4d78f84
SSDEEP 3145728:vO9QNvN0Qh5cgk7J85r/eLQC+Nqk4EWq07m:G9Q5N0icBdUr/Qx+N0Em7m
TLSH
T149383316BA9988FCC699C070C30B4B726A75B0CA1B316DFF46C4CA743E766F51B38619
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-23_14ae4de065de6bfc376d12469ba4077a_akira_amadey_cobalt-strike_glassworm_icedid_rusty-stealer_satacom_vidar
- Size 106.0MB
- SHA256 54eb08b2941c0ca61409d1cae86d2e918684f1f5e3a1091817601652560c3cc2
- MD5 14ae4de065de6bfc376d12469ba4077a
- SHA1 fced4987cb78c96b22a8d195a72e6bff358ac51c
- SHA512 6c604b9db62630cf20b58492b01b9f5e658f9c91e09fcc76b8b7eb1548bab83e75fc881242e2b18db56c350cdef848420468f62d4cdc570a60cb50f1e4d78f84
- SSDEEP 3145728:vO9QNvN0Qh5cgk7J85r/eLQC+Nqk4EWq07m:G9Q5N0icBdUr/Qx+N0Em7m
- TLSH
  T149383316BA9988FCC699C070C30B4B726A75B0CA1B316DFF46C4CA743E766F51B38619
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gh0strat purplefox rat rootkit trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Family: PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Gh0st RAT payload
- Detects executables calling ClearMyTracksByProcess
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- UPX dump on OEP (original entry point)
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

1

T1057

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect PurpleFox Rootkit

Family: Gh0strat

Family: PurpleFox

Gh0st RAT payload

Detects executables calling ClearMyTracksByProcess

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

UPX dump on OEP (original entry point)

ACProtect 1.3x - 1.4x DLL software

Executes dropped EXE

Loads dropped DLL

Discovers running processes

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2