General
-
Target
0fd8fffe21535ac50b22572e57ea09a69286dfc98f58d2acb3442f203e1f8988.exe
-
Size
1.2MB
-
Sample
230405-m6c29sdh26
-
MD5
783cf642bd3c9b40615a5a0553f20a45
-
SHA1
26b575e450189c9b6c4d85f2906fcd5bacb5eb5a
-
SHA256
0fd8fffe21535ac50b22572e57ea09a69286dfc98f58d2acb3442f203e1f8988
-
SHA512
ae4b6e02efe53e3a1cae38b2b819240642ae68698617a6c942299fb600778e2d9236131e4f9fb8ea37417f29323efa7ee5229c3c07e865e36798249f0bfd3a69
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtip:WIwgMEuy+inDfp3/XoCw57XYBwKp
Malware Config
Targets
-
-
Target
0fd8fffe21535ac50b22572e57ea09a69286dfc98f58d2acb3442f203e1f8988.exe
-
Size
1.2MB
-
MD5
783cf642bd3c9b40615a5a0553f20a45
-
SHA1
26b575e450189c9b6c4d85f2906fcd5bacb5eb5a
-
SHA256
0fd8fffe21535ac50b22572e57ea09a69286dfc98f58d2acb3442f203e1f8988
-
SHA512
ae4b6e02efe53e3a1cae38b2b819240642ae68698617a6c942299fb600778e2d9236131e4f9fb8ea37417f29323efa7ee5229c3c07e865e36798249f0bfd3a69
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtip:WIwgMEuy+inDfp3/XoCw57XYBwKp
Score10/10-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Drops file in Drivers directory
-
Sets DLL path for service in the registry
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file
Detects executables packed with VMProtect commercial packer.
-
Adds Run key to start application
-
Drops file in System32 directory
-