Extracted

• • Target
    806b40e6d3c2c8c30ccde5eb8c4daa8c46aa39adb4a9ca410414549db72d39b9
  • Size 611KB
  • SHA256 806b40e6d3c2c8c30ccde5eb8c4daa8c46aa39adb4a9ca410414549db72d39b9
  • MD5 0d849ebd99472d032944588e2a4e14e6
  • SHA1 38822f962955314c02d33251a384cc0c2a3cdf07
  • SHA512 5ee0f304e90c5ed37c2a30e02db0f9dc70a9ed06d729a03b51cf68c52b66b90e24f003015b053fad123550a64a6ef0ceb2f3d9f0c4ced0a5f07d33fce44bcc45
  • SSDEEP 12288:PFpuzZSkcBNrl5mTEUkDaSdJfpSaoNRVBUyMCe8VMM80B7qrI3iK1XBwZQ5m:PFmShDrngEUkDaiJfpSaoNRpMCe8CM8r
  • TLSH
    T1F0D423BEAA4C52A7D48EC97CE11609D39517C1192A9BC3EC9E7C426F2FB893C191F443
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiongh0stratpurplefoxpersistenceratrootkittrojanupx

  • Detect PurpleFox Rootkit

    Detect PurpleFox Rootkit.

    rootkit

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Family: PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox

  • Gh0st RAT payload

  • Drops file in Drivers directory

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2