purplefox | d062e6caa335496805db0ca03be48abc1e3281a20ec4d39f2db23630441d4efa

General

Target
d062e6caa335496805db0ca03be48abc1e3281a20ec4d39f2db23630441d4efa
Size 120KB
Sample220104-f5fcnsaean
SHA256 d062e6caa335496805db0ca03be48abc1e3281a20ec4d39f2db23630441d4efa
MD5 8e2a89b11885abe917aae5c34589f71e
SHA1 237deba57310abce208b49f756b1cdc80d76b03f
SHA512 4f13ef378c89c75a77f0dca2fbb0a38591fdefb7d8f591a49a0edc15794bc05f941179d0a2bd3e2b6a70dc34ace63eb9021b4f0ae49b898af47be18355fc61f3
SSDEEP 3072:wsrBkQRqqzwBcFlCvqFiT4k7NLNU5vJ20:wI2NK2qk/U2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dropper purplefox

Malware Config

Extracted

Family

purplefox

C2

http://193.164.223.77:7456/77

Signatures

Purplefox family
purplefox

File Explorer

d062e6caa335496805db0ca03be48abc1e3281a20ec4d39f2db23630441d4efa

.exe 120KB

d062e6caa335496805db0ca03be48abc1e3281a20ec4d39f2db23630441d4efa

IMPHASH 8c7a2087e32d0d923df57c2cdd7e54d7
SHA256 d062e6caa335496805db0ca03be48abc1e3281a20ec4d39f2db23630441d4efa
MD5 8e2a89b11885abe917aae5c34589f71e
SHA1 237deba57310abce208b49f756b1cdc80d76b03f
SHA512 4f13ef378c89c75a77f0dca2fbb0a38591fdefb7d8f591a49a0edc15794bc05f941179d0a2bd3e2b6a70dc34ace63eb9021b4f0ae49b898af47be18355fc61f3
SSDEEP 3072:wsrBkQRqqzwBcFlCvqFiT4k7NLNU5vJ20:wI2NK2qk/U2
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

15632

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetFileAttributesA GetCurrentProcessId GetModuleFileNameA Sleep CopyFileA FlushFileBuffers CloseHandle CreateFileA WriteConsoleW GetConsoleOutputCP GetSystemTimeAsFileTime GetLastError DeleteFileA GetProcAddress GetModuleHandleA ExitProcess GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap RaiseException RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext FlsGetValue FlsSetValue TlsFree FlsFree SetLastError GetCurrentThreadId FlsAlloc WriteFile GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSection FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapSetInformation HeapCreate QueryPerformanceCounter GetTickCount HeapSize GetCPInfo GetACP GetOEMCP MultiByteToWideChar GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW SetStdHandle WriteConsoleA CreateDirectoryA

user32

GetWindowThreadProcessId ShowWindow EnumWindows GetParent

shell32

ShellExecuteA

urlmon

URLDownloadToFileA

Sharing