Overview

overview

10

Static

static

10

WhatsAppSetupr.exe

windows7_x64

10

WhatsAppSetupr.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WhatsAppSetupr.exe

  • Size

    117KB

  • Sample

    220114-hz1grsfbbm

  • MD5

    83e71f37df8557d87bb44c4c64396802

  • SHA1

    e1ceb77f3a29cd314d047d1bf6e2f984d81bde4d

  • SHA256

    d9c73323bc1f6fb31137e8e0ecec6bbcad6d91e10bccf06948e0d3446e05c23a

  • SHA512

    ddd4c57fbfecfd4398fd5b9b5c628f542d6bf2adb550d8b9748d56c1075ebbc12e15aff72c2b62008d51bc5640b189bb87935f254fc8b1ccbc620f3970aa3c49

Score
10/10
purplefox loaderdropperloaderrootkitsuricatatrojan

Malware Config

Extracted

Family

purplefox

C2

http://107.151.94.67:4397/77

Extracted

Family

purplefox

Targets

    • Target

      WhatsAppSetupr.exe

    • Size

      117KB

    • MD5

      83e71f37df8557d87bb44c4c64396802

    • SHA1

      e1ceb77f3a29cd314d047d1bf6e2f984d81bde4d

    • SHA256

      d9c73323bc1f6fb31137e8e0ecec6bbcad6d91e10bccf06948e0d3446e05c23a

    • SHA512

      ddd4c57fbfecfd4398fd5b9b5c628f542d6bf2adb550d8b9748d56c1075ebbc12e15aff72c2b62008d51bc5640b189bb87935f254fc8b1ccbc620f3970aa3c49

    Score
    10/10
    purplefox loaderdropperloaderrootkitsuricatatrojan

    • Detect PurpleFox Dropper

      Detect PurpleFox Dropper.

      dropper loader

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • suricata: ET MALWARE OneLouder EXE download possibly installing Zeus P2P

      suricata: ET MALWARE OneLouder EXE download possibly installing Zeus P2P

      suricata

    • suricata: ET MALWARE Probable OneLouder downloader (Zeus P2P) exe download

      suricata: ET MALWARE Probable OneLouder downloader (Zeus P2P) exe download

      suricata

    • suricata: ET MALWARE PurpleFox Backdoor/Rootkit Checkin

      suricata: ET MALWARE PurpleFox Backdoor/Rootkit Checkin

      suricata

    • suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Request M1

      suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Request M1

      suricata

    • suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Server Response M1

      suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Server Response M1

      suricata

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks