Overview

overview

10

Static

static

3

d09a24d602...60.exe

windows7-x64

10

d09a24d602...60.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d09a24d6024bb7ba43e61cf81f0507bc6af82d75437d76813ca4c6d6366db760

  • Size

    264KB

  • Sample

    230530-fdf5wsfc38

  • MD5

    ef5845f28bad21d0d1d388a17a95d777

  • SHA1

    64a1e0b9265742b4f5d02bcc91027ba26f5322cc

  • SHA256

    d09a24d6024bb7ba43e61cf81f0507bc6af82d75437d76813ca4c6d6366db760

  • SHA512

    73240c604643c4dd26035031eaf1c3f5707634b6e3347df19e465c43290a370a6e04e21231cac2217791232fe5ef6c789da6fb2e697afcc2ca9c1b2250bde5c8

  • SSDEEP

    6144:rzLsl1tTKx80OPo0N+HvjCrtAuu8EQyL+3Y1tMmbWs:j0TTKx8fKv2quuD+3Y12wW

Score
10/10
gh0stratpurplefoxratrootkittrojan

Malware Config

Targets

    • Target

      d09a24d6024bb7ba43e61cf81f0507bc6af82d75437d76813ca4c6d6366db760

    • Size

      264KB

    • MD5

      ef5845f28bad21d0d1d388a17a95d777

    • SHA1

      64a1e0b9265742b4f5d02bcc91027ba26f5322cc

    • SHA256

      d09a24d6024bb7ba43e61cf81f0507bc6af82d75437d76813ca4c6d6366db760

    • SHA512

      73240c604643c4dd26035031eaf1c3f5707634b6e3347df19e465c43290a370a6e04e21231cac2217791232fe5ef6c789da6fb2e697afcc2ca9c1b2250bde5c8

    • SSDEEP

      6144:rzLsl1tTKx80OPo0N+HvjCrtAuu8EQyL+3Y1tMmbWs:j0TTKx8fKv2quuD+3Y12wW

    Score
    10/10
    gh0stratpurplefoxratrootkittrojan

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks