Extracted

Extracted

Extracted

• • Target

    608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff

  • Size

    186KB

  • MD5

    2ed8df319374ded66ac933e7b44eb270

  • SHA1

    5f237f5ee1cf93f9860aa3264337727fea796e1d

  • SHA256

    608b3486309d15bed054e22e20d87c44e43a6cde3dad6942ef592c9d3c4f3cff

  • SHA512

    0c1a5e1f7ab3e82d0c304809b488ba48c7d48c175a53480f26c616c69649caa67f937c6a475b3ed117514255d150cbb1f38cd5de1576fd216ebc4d38c7779c80

  Score

  10^/10

  purplefoxsainbox loaderdropperloaderrootkittrojan

  • Detect PurpleFox Dropper

    Detect PurpleFox Dropper.

    dropper loader

  • Detect PurpleFox Rootkit

    Detect PurpleFox Rootkit.

    rootkit

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1