gh0strat

General

Target

fb34095a4f6fc662382827526c7688593a076506091304348aff5fc13b0ebe1c
Size

3.1MB
Sample

240630-ed5mtatdlh
MD5

9248a9fc5df948dbb159b679f115fa35
SHA1

45cfa6903b5a4b6b591769cab17dc4981c915918
SHA256

fb34095a4f6fc662382827526c7688593a076506091304348aff5fc13b0ebe1c
SHA512

43d383cf3218c1570f3444dab9d493f866c77c338b9f690b0ac40644497125939e3f9dbd56b6977e2ffe0deb631b8fb5ae064c063427d4e3fc3d48608caefddb
SSDEEP

49152:6CwsbCANnKXferL7Vwe/Gg0P+WhKGalI81eaS0hK:tws2ANnKXOaeOgmhKGiI8189

Score

10^/10

Malware Config

Targets

- Target
  
  fb34095a4f6fc662382827526c7688593a076506091304348aff5fc13b0ebe1c
- Size
  
  3.1MB
- MD5
  
  9248a9fc5df948dbb159b679f115fa35
- SHA1
  
  45cfa6903b5a4b6b591769cab17dc4981c915918
- SHA256
  
  fb34095a4f6fc662382827526c7688593a076506091304348aff5fc13b0ebe1c
- SHA512
  
  43d383cf3218c1570f3444dab9d493f866c77c338b9f690b0ac40644497125939e3f9dbd56b6977e2ffe0deb631b8fb5ae064c063427d4e3fc3d48608caefddb
- SSDEEP
  
  49152:6CwsbCANnKXferL7Vwe/Gg0P+WhKGalI81eaS0hK:tws2ANnKXOaeOgmhKGiI8189
Score

10^/10

gh0strat purplefox bootkit persistence rat rootkit trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- UPX dump on OEP (original entry point)
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Targets

Detect PurpleFox Rootkit

Gh0st RAT payload

PurpleFox

UPX dump on OEP (original entry point)

Drops file in Drivers directory

Server Software Component: Terminal Services DLL

Sets service image path in registry

Executes dropped EXE

Loads dropped DLL

UPX packed file

Writes to the Master Boot Record (MBR)

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2