gh0strat | f62b8572633bf90ea19117403feb2be5aa3f26f72703329c5896f1c37dbb8029

General

Target
2026-10-10_a3a67c34f7a56a4ccd73e411c5e13bae_elex_emotet_icedid_luca-stealer_njrat_remcos_stealc_vidar_wannacry
Size 42.7MB
Sample261011-hdt3vsxtbs
SHA256 f62b8572633bf90ea19117403feb2be5aa3f26f72703329c5896f1c37dbb8029
MD5 a3a67c34f7a56a4ccd73e411c5e13bae
SHA1 b01aae4454ffc3da577fa8647347946dded9a1cd
SHA512 68c7d077a0c321a8d380709fb817c0627d27cabff3ed89e3416ef63ed3baa95fb7dfebe96bbb01ffca1a6d5ed30a1f05192cd496f51dbb0ab7341d991d2c416e
SSDEEP 786432:kkED7OEXO2F0L7kPbbFtAWCq6vrn9TIc1rvYIUU8XSqF:kjlXDWEFK/r9/Y5UeF
TLSH
T1CEA712C665D401F8C3C29630DF8612AAB290315E53F949EF32C81CC53A61E96FA5AF77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-10_a3a67c34f7a56a4ccd73e411c5e13bae_elex_emotet_icedid_luca-stealer_njrat_remcos_stealc_vidar_wannacry
- Size 42.7MB
- SHA256 f62b8572633bf90ea19117403feb2be5aa3f26f72703329c5896f1c37dbb8029
- MD5 a3a67c34f7a56a4ccd73e411c5e13bae
- SHA1 b01aae4454ffc3da577fa8647347946dded9a1cd
- SHA512 68c7d077a0c321a8d380709fb817c0627d27cabff3ed89e3416ef63ed3baa95fb7dfebe96bbb01ffca1a6d5ed30a1f05192cd496f51dbb0ab7341d991d2c416e
- SSDEEP 786432:kkED7OEXO2F0L7kPbbFtAWCq6vrn9TIc1rvYIUU8XSqF:kjlXDWEFK/r9/Y5UeF
- TLSH
  T1CEA712C665D401F8C3C29630DF8612AAB290315E53F949EF32C81CC53A61E96FA5AF77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution gh0strat purplefox persistence rat rootkit trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Family: PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Gh0st RAT payload
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Uses WMI to collect hardware manufacturer information
  Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2