Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
06-08-2023 17:16
General
-
Target
dfaa03cae7ec7e38929ee6ef30177a6f11c803a9ef0c9b4d9fdedd66e34eb412.exe
-
Size
396KB
-
MD5
c35fca48eaa66953dcda1ad7f3fc5ed1
-
SHA1
eb4b8f48e0d9c2a29fa06c8597f5b1b398a11501
-
SHA256
dfaa03cae7ec7e38929ee6ef30177a6f11c803a9ef0c9b4d9fdedd66e34eb412
-
SHA512
c8e036fb318fb458a85d80cd606da8095de9940d6103f24f9cdc2182a15a9a2edff083614091cac34df730638cdc02ca67fce9a2fbb12062091e8d7783c3f4e7
-
SSDEEP
12288:sb5DbPowllDRf9Ib2JONfUcri1RcQP2aD:s9Dbg6lV9C2JOBUIc12aD
Malware Config
Signatures
-
Detect PurpleFox Rootkit 4 IoCs
Detect PurpleFox Rootkit.
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfaa03cae7ec7e38929ee6ef30177a6f11c803a9ef0c9b4d9fdedd66e34eb412.exe"C:\Users\Admin\AppData\Local\Temp\dfaa03cae7ec7e38929ee6ef30177a6f11c803a9ef0c9b4d9fdedd66e34eb412.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB