General

  • Target

    tmp

  • Size

    2.0MB

  • Sample

    230608-gw4jksch55

  • MD5

    d16871273c78fae84aa251223a2edfb6

  • SHA1

    00a4fef97b36c48ad3f45566ef76098b8cdfb2b1

  • SHA256

    36d6547fb91b2dfa689fae91ff429dadc7cd5550fffbb9c743947ca7e7f50fed

  • SHA512

    fa25c5b24263a5376dca7816ff8b8d947a006704bc9415e011465c32fa81984e51f00bab2ab1092929356a810fa38f14589559d0abae1df7d9ea494d93019f63

  • SSDEEP

    24576:unsJ39LyjbJkQFMhmC+6GD9MnBEuHaFXeBpVSlsCMsSRq3VRD5uJb26WME:unsHyjtk2MYC5GDudH9tsLxu5WL

Malware Config

Targets

    • Target

      tmp

    • Size

      2.0MB

    • MD5

      d16871273c78fae84aa251223a2edfb6

    • SHA1

      00a4fef97b36c48ad3f45566ef76098b8cdfb2b1

    • SHA256

      36d6547fb91b2dfa689fae91ff429dadc7cd5550fffbb9c743947ca7e7f50fed

    • SHA512

      fa25c5b24263a5376dca7816ff8b8d947a006704bc9415e011465c32fa81984e51f00bab2ab1092929356a810fa38f14589559d0abae1df7d9ea494d93019f63

    • SSDEEP

      24576:unsJ39LyjbJkQFMhmC+6GD9MnBEuHaFXeBpVSlsCMsSRq3VRD5uJb26WME:unsHyjtk2MYC5GDudH9tsLxu5WL

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

2
T1060

Defense Evasion

Modify Registry

3
T1112

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Tasks