General
-
Target
e26d98ab1e3a5bb2b637dedd02182856e6320e26df0beadc155f986be838c16b
-
Size
7KB
-
Sample
220927-nlpq1adda3
-
MD5
5bbf8c19d72720a9be9ed8cd3b40dda2
-
SHA1
98729095a86b6c2683ef944acea30ffd7a87eefb
-
SHA256
e26d98ab1e3a5bb2b637dedd02182856e6320e26df0beadc155f986be838c16b
-
SHA512
9792049f3d539bf2a1d03aec8f887a793d8301aa5ae56f329f09c423f1371273a1a71f2b1613da7eca60ea0a29d53c46f3a174b60f599d78a917828bc2ffdf66
-
SSDEEP
192:rjJLfclnR8rh59wK1C9QILJ/LT3yztVRWPle:BfcNk7I9fLdLT30kle
Malware Config
Targets
-
-
Target
9.27USDT·ַʵ.exe
-
Size
36KB
-
MD5
f03f5610257f8dd2968b516d74621b78
-
SHA1
3da92c0ccbe7a331e1dfa7b870f2ad945aaa2045
-
SHA256
fec33611d9bc68875811e7bbac111b2682512e16e4ca6ae0b2db774623978cf2
-
SHA512
fed52e5ad9388fbf4c813801bce31f1f9adf39572ec970871d36b92836e27a62329af3b277e58c815a19460bbfaef3c4f45cb70d6aefe798c660cdc803ef142b
-
SSDEEP
192:600maRBUda7n9JlU2g1jJMOEyKbIYymt5XTtEyKihoynKwHLHTgH9N2tpgRmd8MS:609Bdq9JGqO+NxhjAdN2tpgwd5ASc
Score10/10-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
UAC bypass
-
Downloads MZ/PE file
-
Executes dropped EXE
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
An obfuscated cmd.exe command-line is typically used to evade detection.
-
Suspicious use of SetThreadContext
-