Overview

overview

10

Static

static

3

bb6e2be73a...f6.exe

windows7-x64

10

bb6e2be73a...f6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bb6e2be73a2d3c797fbf1d198e3652172b0eef90cb3d315724830ff855c8eff6

  • Size

    4.3MB

  • Sample

    230816-enl88aha61

  • MD5

    8ac3c64e85b5848496e981725b1de254

  • SHA1

    a87133eee866e9f97990e4d88a0163446609c7ad

  • SHA256

    bb6e2be73a2d3c797fbf1d198e3652172b0eef90cb3d315724830ff855c8eff6

  • SHA512

    c7b96277814f17eb57420c2925c18fa05efc644452a2d7ae0801b40623c71ea17a85508a22a27a068d06cc6c868334ca4f61dbed733e91627c3aed252f267ac9

  • SSDEEP

    98304:pZJt4HINy2LkosReElDIJ60CV57Bb+nMUkTMiFsnJVq4XJ8:riINy2LkjAJeb71+nMUkImk8

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      bb6e2be73a2d3c797fbf1d198e3652172b0eef90cb3d315724830ff855c8eff6

    • Size

      4.3MB

    • MD5

      8ac3c64e85b5848496e981725b1de254

    • SHA1

      a87133eee866e9f97990e4d88a0163446609c7ad

    • SHA256

      bb6e2be73a2d3c797fbf1d198e3652172b0eef90cb3d315724830ff855c8eff6

    • SHA512

      c7b96277814f17eb57420c2925c18fa05efc644452a2d7ae0801b40623c71ea17a85508a22a27a068d06cc6c868334ca4f61dbed733e91627c3aed252f267ac9

    • SSDEEP

      98304:pZJt4HINy2LkosReElDIJ60CV57Bb+nMUkTMiFsnJVq4XJ8:riINy2LkjAJeb71+nMUkImk8

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks