purplefox | 87b776b386b0815fea7cb8b3ac9c1261bd7f1ccfa2a84c05c171131ad905f07e

General

Target
87b776b386b0815fea7cb8b3ac9c1261bd7f1ccfa2a84c05c171131ad905f07e
Size 1.5MB
Sample261005-v5f2jayeqh
SHA256 87b776b386b0815fea7cb8b3ac9c1261bd7f1ccfa2a84c05c171131ad905f07e
MD5 6bed58ca03a5688604d1a5b95bef5a9a
SHA1 e3b29f1113d76bbc58bf478660ccfb6d7a4ec6c1
SHA512 cf483678d6a47362da94d456e9de5a95e8448f037be206fc5e0158f821b533804748f87a5681cede32848194162720896d052ae2cff08b1ee602b5d7bff80211
SSDEEP 24576:7MfywgIt/65Fu99573/aiVIOYrFzpCM5hyv3m8AMtRyce0LCOK0B:l49rJ
TLSH
T129755C83F2B64CE3CBD40034EC6AD2767B34791D93FB86737240DAD6B5A6690792035A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rootkit upx trojan purplefox rat gh0strat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
sample	purplefox_rootkit

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
87b776b386b0815fea7cb8b3ac9c1261bd7f1ccfa2a84c05c171131ad905f07e

File Explorer

87b776b386b0815fea7cb8b3ac9c1261bd7f1ccfa2a84c05c171131ad905f07e

.dll 1.5MB

87b776b386b0815fea7cb8b3ac9c1261bd7f1ccfa2a84c05c171131ad905f07e

SHA256 87b776b386b0815fea7cb8b3ac9c1261bd7f1ccfa2a84c05c171131ad905f07e
MD5 6bed58ca03a5688604d1a5b95bef5a9a
SHA1 e3b29f1113d76bbc58bf478660ccfb6d7a4ec6c1
SHA512 cf483678d6a47362da94d456e9de5a95e8448f037be206fc5e0158f821b533804748f87a5681cede32848194162720896d052ae2cff08b1ee602b5d7bff80211
SSDEEP 24576:7MfywgIt/65Fu99573/aiVIOYrFzpCM5hyv3m8AMtRyce0LCOK0B:l49rJ
TLSH
T129755C83F2B64CE3CBD40034EC6AD2767B34791D93FB86737240DAD6B5A6690792035A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detect PurpleFox Rootkit

Detect PurpleFox Rootkit.

rootkit
Gh0st RAT payload
ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1789008

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

generic

count=1, id=49, version=9044,

count=58, id=48, version=9044,

count=75, productName=Unmarked objects (old),

count=4, id=12, version=7291,

count=10, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=34, id=14, version=7299,

count=137, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=3, id=11, version=8047,

count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=31, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=345, id=1, productName=Unmarked objects,

count=13, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=29, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=2, id=18, version=8444,

count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,

Sharing