purplefox | WhatsAppSetupr[.]exe

General

Target
WhatsAppSetupr.exe
Size 117KB
Sample220114-hz1grsfbbm
SHA256 d9c73323bc1f6fb31137e8e0ecec6bbcad6d91e10bccf06948e0d3446e05c23a
MD5 83e71f37df8557d87bb44c4c64396802
SHA1 e1ceb77f3a29cd314d047d1bf6e2f984d81bde4d
SHA512 ddd4c57fbfecfd4398fd5b9b5c628f542d6bf2adb550d8b9748d56c1075ebbc12e15aff72c2b62008d51bc5640b189bb87935f254fc8b1ccbc620f3970aa3c49
SSDEEP 1536:+UMzhqcfmu5R6C6WGLSzd3/dvt8O0/R6Fz9tTy:+UY5ROGV0/R6FzLTy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dropper purplefox

Malware Config

Extracted

Family

purplefox

C2

http://107.151.94.67:4397/77

Signatures

Purplefox family
purplefox

File Explorer

WhatsAppSetupr.exe

.exe 117KB

WhatsAppSetupr.exe

IMPHASH bddfe31442a91c9af31da09e61e1b59e
SHA256 d9c73323bc1f6fb31137e8e0ecec6bbcad6d91e10bccf06948e0d3446e05c23a
MD5 83e71f37df8557d87bb44c4c64396802
SHA1 e1ceb77f3a29cd314d047d1bf6e2f984d81bde4d
SHA512 ddd4c57fbfecfd4398fd5b9b5c628f542d6bf2adb550d8b9748d56c1075ebbc12e15aff72c2b62008d51bc5640b189bb87935f254fc8b1ccbc620f3970aa3c49
SSDEEP 1536:+UMzhqcfmu5R6C6WGLSzd3/dvt8O0/R6Fz9tTy:+UY5ROGV0/R6FzLTy
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

11502

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA GetProcAddress GetModuleFileNameA Sleep CopyFileA CreateToolhelp32Snapshot Process32First Process32Next CloseHandle CreateMutexA GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA GetSystemTimeAsFileTime GetFileAttributesA DeleteFileA GetModuleHandleW ExitProcess GetCommandLineA GetStartupInfoA HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc RaiseException TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId VirtualAlloc HeapReAlloc RtlUnwind HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode CreateDirectoryA

user32

EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcA DestroyWindow DialogBoxParamA RegisterClassExA LoadCursorA LoadIconA LoadStringA

Sharing