Extracted

• • Target
    2026-09-26_fb76e19e0ee08c7e56e5eae7f22157c1_cloudeye_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_remcos_wannacry
  • Size 10.2MB
  • SHA256 6b99f019c5bdf00934d8b8c60137af4dede5d7a457b4dd91cb827f3a03fc95cf
  • MD5 fb76e19e0ee08c7e56e5eae7f22157c1
  • SHA1 4d3999149711d51a3ec55f795cdab8d735d15453
  • SHA512 29d241d277ad40926f2f6336a17c2ed8f206aa755ecd2a19c1c50641f9dbfa9d75b037bcd8bb856eab59803bfb33d653d497fdc018953fcd8f6daf0aee86ce1a
  • SSDEEP 196608:oKXbeO7evtLwg2r775IoENtS2vfrzY+UtDrLtfpRp:R7KtPsP5INvXjUZLxDp
  • TLSH
    T1C7B60113B1914472C7892771DE67DAB29B257E6D2FF2423E7B98BDC83B353407A21221
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutiongh0stratpurplefoxxredpersistenceratrootkitspywarestealertrojanupx

  • Detect PurpleFox Rootkit

    Detect PurpleFox Rootkit.

    rootkit

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Family: PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Gh0st RAT payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables containing URLs to raw contents of a Github gist

  • UPX dump on OEP (original entry point)

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Server Software Component: Terminal Services DLL

    persistence

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2