Overview

overview

10

Static

static

1

9793003669...c0.exe

windows7-x64

10

9793003669...c0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    40ac2a5a4ea898a9b4b7009062c63b15.bin

  • Size

    619KB

  • Sample

    230423-bt13sabf5y

  • MD5

    e58247f448dcc9ac374005939c8cc013

  • SHA1

    948966d657f367895dd6612c2542d5dc4645e986

  • SHA256

    1e42e563f586bf8f626e1b4d0782076a11baf907dea95e6ffff6c5fb7cc8eb1e

  • SHA512

    0b8d1bf9dac558ab132d1bbb6a8bb0f3d111f98185b243d77b7d967d3adbf0af71383cf3761944d9e14ef8b8aa4d8866886e73b5a215f73f736506b76ec4c875

  • SSDEEP

    12288:9V7xVc7kznVVH3O2cnyAZXxUoZBB6NwIvkNTiZmfZciZt+N9CTz1lhUxoOcuFp:HekTzexnJ5xFdQsNT/fFZKc9lGoNA

Score
10/10
gh0stratpurplefoxratrootkittrojan

Malware Config

Targets

    • Target

      9793003669bcb9826d31c8dbb1c2d51097f661540d01ff8fffeb30ae1332a3c0.exe

    • Size

      1.6MB

    • MD5

      40ac2a5a4ea898a9b4b7009062c63b15

    • SHA1

      6cb2de3ac7ec7efc7e8483ecf0e015b9c2819421

    • SHA256

      9793003669bcb9826d31c8dbb1c2d51097f661540d01ff8fffeb30ae1332a3c0

    • SHA512

      03908bedfee4ecf0e4a56ba9d40e657569bd3240a798d2d74e316236ab027fed791640915e8d72f49680301c08546af3b10ce05533196da28e4473da80708a3c

    • SSDEEP

      24576:ErJ+YtE0c1dxUnh+rgERYIeUUVJH7pbFnGIvaBnpL:+tY1e+rzRYjUUZ

    Score
    10/10
    gh0stratpurplefoxratrootkittrojan

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks