General
-
Target
1a9fe66fe227f36c14c880b4f3d49eb602ed2d45fff6672679845ae8476cca40.exe
-
Size
1.2MB
-
Sample
230405-m7dp7aeb83
-
MD5
03d550dc797ad7ae8969b4cfddeab414
-
SHA1
c638606cf520bb84398899e945528b45cc2af294
-
SHA256
1a9fe66fe227f36c14c880b4f3d49eb602ed2d45fff6672679845ae8476cca40
-
SHA512
36d4fff7e50b5bf533ef4a12d6351cb28e4ac5d13941f8106b962d80e615c4d44036d30675e6e4ddc83f5a8fc63b3eb3af90798ff59f9fdbb48b7dcd1796aa68
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJti3:WIwgMEuy+inDfp3/XoCw57XYBwK3
Malware Config
Targets
-
-
Target
1a9fe66fe227f36c14c880b4f3d49eb602ed2d45fff6672679845ae8476cca40.exe
-
Size
1.2MB
-
MD5
03d550dc797ad7ae8969b4cfddeab414
-
SHA1
c638606cf520bb84398899e945528b45cc2af294
-
SHA256
1a9fe66fe227f36c14c880b4f3d49eb602ed2d45fff6672679845ae8476cca40
-
SHA512
36d4fff7e50b5bf533ef4a12d6351cb28e4ac5d13941f8106b962d80e615c4d44036d30675e6e4ddc83f5a8fc63b3eb3af90798ff59f9fdbb48b7dcd1796aa68
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJti3:WIwgMEuy+inDfp3/XoCw57XYBwK3
Score10/10-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Drops file in Drivers directory
-
Sets DLL path for service in the registry
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file
Detects executables packed with VMProtect commercial packer.
-
Adds Run key to start application
-
Drops file in System32 directory
-