General

  • Target

    05912fabb84b2de4dae04ee14239681fb70bba68f92394a1512463ad45cd1052

  • Size

    2.3MB

  • Sample

    230822-3ekk2ahf2v

  • MD5

    9a0e7678e99622ab7260c4269ed40ccc

  • SHA1

    94e812e4cd299844600045f569e99442f49a2d87

  • SHA256

    05912fabb84b2de4dae04ee14239681fb70bba68f92394a1512463ad45cd1052

  • SHA512

    924d3fd93010cad45ec45b8107aa87cd1ca8b2e97f7223db2b00ccf0293bd94cd0bb94b493835fba012982fe707098251f9e5693a1ca5f8b19249508537460a9

  • SSDEEP

    24576:+CwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHh:+CwsbCANnKXferL7Vwe/Gg0P+WhQ

Malware Config

Targets

    • Target

      05912fabb84b2de4dae04ee14239681fb70bba68f92394a1512463ad45cd1052

    • Size

      2.3MB

    • MD5

      9a0e7678e99622ab7260c4269ed40ccc

    • SHA1

      94e812e4cd299844600045f569e99442f49a2d87

    • SHA256

      05912fabb84b2de4dae04ee14239681fb70bba68f92394a1512463ad45cd1052

    • SHA512

      924d3fd93010cad45ec45b8107aa87cd1ca8b2e97f7223db2b00ccf0293bd94cd0bb94b493835fba012982fe707098251f9e5693a1ca5f8b19249508537460a9

    • SSDEEP

      24576:+CwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHh:+CwsbCANnKXferL7Vwe/Gg0P+WhQ

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Sets DLL path for service in the registry

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks