General

  • Target

    22ace854b60086386af755eb86877b37367ed8ca44145857a5c7ab03218f55d9

  • Size

    2.9MB

  • Sample

    230820-b27kjaee9v

  • MD5

    b51b9f38abc0a0489533247f5c3679c6

  • SHA1

    597a360dea9afe659bac8c17d9870bd16dae18ce

  • SHA256

    22ace854b60086386af755eb86877b37367ed8ca44145857a5c7ab03218f55d9

  • SHA512

    5a6d9abe1a3f448ebbd43599b7157e20656daa46a00a7a95c1002df8b87be34e92956dfb99de023be5f468bd67ca2e37ede663b6ec6c220d052824142cb81fa9

  • SSDEEP

    49152:ICwsbCANnKXferL7Vwe/Gg0P+WhuwToEQncvij:Dws2ANnKXOaeOgmhuwTdQV

Malware Config

Targets

    • Target

      22ace854b60086386af755eb86877b37367ed8ca44145857a5c7ab03218f55d9

    • Size

      2.9MB

    • MD5

      b51b9f38abc0a0489533247f5c3679c6

    • SHA1

      597a360dea9afe659bac8c17d9870bd16dae18ce

    • SHA256

      22ace854b60086386af755eb86877b37367ed8ca44145857a5c7ab03218f55d9

    • SHA512

      5a6d9abe1a3f448ebbd43599b7157e20656daa46a00a7a95c1002df8b87be34e92956dfb99de023be5f468bd67ca2e37ede663b6ec6c220d052824142cb81fa9

    • SSDEEP

      49152:ICwsbCANnKXferL7Vwe/Gg0P+WhuwToEQncvij:Dws2ANnKXOaeOgmhuwTdQV

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Sets DLL path for service in the registry

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks