Overview

overview

10

Static

static

7

79fdafce84...db.exe

windows7-x64

10

79fdafce84...db.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    79fdafce8486c84c63a01fa7353da03952fc430576f4f3d53ac8cdb517ec18db

  • Size

    456KB

  • Sample

    230805-vyvw4sfb7w

  • MD5

    5ec615ccfed7ff83c807ea70ec797542

  • SHA1

    82ce31c4b2ca78fa5b9373b8da51eb77af0553eb

  • SHA256

    79fdafce8486c84c63a01fa7353da03952fc430576f4f3d53ac8cdb517ec18db

  • SHA512

    f27ed255a3384115a3a3a02397753176e73f0ea154720d9f7e3181870283040f393868a8b4d3c07b2f4f8a82bd8e38f91bb0109de7a854db9c694f8ee1b22447

  • SSDEEP

    12288:v8noxguizghvk2u+hbprhJysvBMBMQyOgZT8w2ja8:v6oazh2ltrhJPBSYOg7ua

Score
10/10
gh0stratpurplefoxratrootkittrojanupxvmprotect

Malware Config

Targets

    • Target

      79fdafce8486c84c63a01fa7353da03952fc430576f4f3d53ac8cdb517ec18db

    • Size

      456KB

    • MD5

      5ec615ccfed7ff83c807ea70ec797542

    • SHA1

      82ce31c4b2ca78fa5b9373b8da51eb77af0553eb

    • SHA256

      79fdafce8486c84c63a01fa7353da03952fc430576f4f3d53ac8cdb517ec18db

    • SHA512

      f27ed255a3384115a3a3a02397753176e73f0ea154720d9f7e3181870283040f393868a8b4d3c07b2f4f8a82bd8e38f91bb0109de7a854db9c694f8ee1b22447

    • SSDEEP

      12288:v8noxguizghvk2u+hbprhJysvBMBMQyOgZT8w2ja8:v6oazh2ltrhJPBSYOg7ua

    Score
    10/10
    gh0stratpurplefoxratrootkittrojanupxvmprotect

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks