Overview

overview

10

Static

static

3

047068edaf...4a.exe

windows7-x64

10

047068edaf...4a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    047068edaf680fed440a896cba5dfe3bf580bd1f81d123672d05f4ae1e1ff34a

  • Size

    3.4MB

  • Sample

    230813-k1yexacb6v

  • MD5

    4597dc0e3f5f215f15f5e1371aac1027

  • SHA1

    439adfe20a54d3a261b6dea21aa511c3d61b545b

  • SHA256

    047068edaf680fed440a896cba5dfe3bf580bd1f81d123672d05f4ae1e1ff34a

  • SHA512

    82260fd15c10173b9872b6031b57014623e121f3ecfac6b215f6e17dd7ce5110556a997195df5b8552ab146169ae062f0185182afa8d38d2a0d02a11abada827

  • SSDEEP

    49152:xCwsbCANnKXferL7Vwe/Gg0P+WhvExoIK+izmHMTq:8ws2ANnKXOaeOgmh1It1

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      047068edaf680fed440a896cba5dfe3bf580bd1f81d123672d05f4ae1e1ff34a

    • Size

      3.4MB

    • MD5

      4597dc0e3f5f215f15f5e1371aac1027

    • SHA1

      439adfe20a54d3a261b6dea21aa511c3d61b545b

    • SHA256

      047068edaf680fed440a896cba5dfe3bf580bd1f81d123672d05f4ae1e1ff34a

    • SHA512

      82260fd15c10173b9872b6031b57014623e121f3ecfac6b215f6e17dd7ce5110556a997195df5b8552ab146169ae062f0185182afa8d38d2a0d02a11abada827

    • SSDEEP

      49152:xCwsbCANnKXferL7Vwe/Gg0P+WhvExoIK+izmHMTq:8ws2ANnKXOaeOgmh1It1

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks