gh0strat | 311d2fa46a5a1cc5f6eccccdeddae843b17c5e239c50fdb1a089712e208b30af

General

Target
2026-09-10_c8feba3b76e75eb3ac50bfc8c69e7729_coinminer_elex_wannacry
Size 4.6MB
Sample260910-mscjks1hpg
SHA256 311d2fa46a5a1cc5f6eccccdeddae843b17c5e239c50fdb1a089712e208b30af
MD5 c8feba3b76e75eb3ac50bfc8c69e7729
SHA1 083e4112bf2b5dddc696936449ed863f88f5977a
SHA512 86af48da185576bd141daab981f2e25625a522cd275705934f3f3883871e78be4595129e324c96ece58e12a89284b237460fdc1b43ed1a1357e9f8b453929038
SSDEEP 98304:XWU7uw3i4OWqzwrvXSDw5U7YJpSC2yfV2YgiwJypxLuNnHvJ2GM:G6ui9XvXRGYJP2eV+iwkSh2GM
TLSH
T1B5263376B380CE34CED82CB4AA42C27428E67C5386598BC67048FA4AE135BDCFF5556D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-10_c8feba3b76e75eb3ac50bfc8c69e7729_coinminer_elex_wannacry
- Size 4.6MB
- SHA256 311d2fa46a5a1cc5f6eccccdeddae843b17c5e239c50fdb1a089712e208b30af
- MD5 c8feba3b76e75eb3ac50bfc8c69e7729
- SHA1 083e4112bf2b5dddc696936449ed863f88f5977a
- SHA512 86af48da185576bd141daab981f2e25625a522cd275705934f3f3883871e78be4595129e324c96ece58e12a89284b237460fdc1b43ed1a1357e9f8b453929038
- SSDEEP 98304:XWU7uw3i4OWqzwrvXSDw5U7YJpSC2yfV2YgiwJypxLuNnHvJ2GM:G6ui9XvXRGYJP2eV+iwkSh2GM
- TLSH
  T1B5263376B380CE34CED82CB4AA42C27428E67C5386598BC67048FA4AE135BDCFF5556D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution gh0strat purplefox persistence rat rootkit spyware stealer trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Family: PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Gh0st RAT payload
- Detects executables calling ClearMyTracksByProcess
- UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2