gh0strat

General

Target

0412aa061e426fb6a078408c966ed232a75e01c4a2febbec454b89b05cee92fb
Size

2.1MB
Sample

240701-e67mwazcmp
MD5

9abbbab52c30fb0354096330e4af439a
SHA1

371e920401ffa2f46d3643a3fe86654b2f627198
SHA256

0412aa061e426fb6a078408c966ed232a75e01c4a2febbec454b89b05cee92fb
SHA512

9b949ade92369d47a77891323b3577c09e0a0dc443a218e1a7b0c1d63455a38869a65c5d98b9c253f92ccbd3062e34fb9e06adfc16786970d3b1c75480424855
SSDEEP

24576:k09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+ZY83qV49:k09XJt4HIN2H2tFvduyS//ae

Score

10^/10

Malware Config

Targets

- Target
  
  0412aa061e426fb6a078408c966ed232a75e01c4a2febbec454b89b05cee92fb
- Size
  
  2.1MB
- MD5
  
  9abbbab52c30fb0354096330e4af439a
- SHA1
  
  371e920401ffa2f46d3643a3fe86654b2f627198
- SHA256
  
  0412aa061e426fb6a078408c966ed232a75e01c4a2febbec454b89b05cee92fb
- SHA512
  
  9b949ade92369d47a77891323b3577c09e0a0dc443a218e1a7b0c1d63455a38869a65c5d98b9c253f92ccbd3062e34fb9e06adfc16786970d3b1c75480424855
- SSDEEP
  
  24576:k09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+ZY83qV49:k09XJt4HIN2H2tFvduyS//ae
Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx discovery evasion spyware stealer
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Drops file in Drivers directory
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Targets

Detect PurpleFox Rootkit

Gh0st RAT payload

PurpleFox

Drops file in Drivers directory

Sets service image path in registry

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

UPX packed file

Checks installed software on the system

Checks whether UAC is enabled

Checks system information in the registry

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2