Overview

overview

10

Static

static

10

NA_07ed0ef...JC.exe

windows10-2004-x64

10

Resubmissions

22-07-2023 22:23

230722-2a5vqsce56 10

22-07-2023 22:16

230722-16y7dsce26 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NA_07ed0ef84efce4exe_JC.exe

  • Size

    10.9MB

  • Sample

    230722-2a5vqsce56

  • MD5

    07ed0ef84efce475c96e02fc359cf55d

  • SHA1

    68481020b069608200a38e0c8e3549ae1a5e8c9e

  • SHA256

    20ba77f7ae1761062acd954a950ca8505ccea819a64ca4f611f1b2bbe2bce98e

  • SHA512

    cc27062d5eed294fb4f2d78b1fd7013fd0fd63740e8b3a7a9ea6942e87fb967ceb83cafbcf7d1b6f42d0d37cf46150ae9688e0558416c1877ccf890e2379695a

  • SSDEEP

    196608:r4eZJ4ef4eZYAbIsZ9Mo9VP4m9VBkKcvQitGwzFvJwD1apJy9yf2PL9rR33J:X9m8VBUvFtGUK1MTf2j9rn

Score
10/10
blackmoongh0stratpurplefoxbankerpyinstallerratrootkittrojanupx

Malware Config

Targets

    • Target

      NA_07ed0ef84efce4exe_JC.exe

    • Size

      10.9MB

    • MD5

      07ed0ef84efce475c96e02fc359cf55d

    • SHA1

      68481020b069608200a38e0c8e3549ae1a5e8c9e

    • SHA256

      20ba77f7ae1761062acd954a950ca8505ccea819a64ca4f611f1b2bbe2bce98e

    • SHA512

      cc27062d5eed294fb4f2d78b1fd7013fd0fd63740e8b3a7a9ea6942e87fb967ceb83cafbcf7d1b6f42d0d37cf46150ae9688e0558416c1877ccf890e2379695a

    • SSDEEP

      196608:r4eZJ4ef4eZYAbIsZ9Mo9VP4m9VBkKcvQitGwzFvJwD1apJy9yf2PL9rR33J:X9m8VBUvFtGUK1MTf2j9rn

    Score
    10/10
    blackmoongh0stratpurplefoxbankerpyinstallerratrootkittrojanupx

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks