General

  • Target

    9af51dc0660455ffba599c9d6206cdf5a82d5678d1b9f39292f20fd30ba568c9

  • Size

    2.4MB

  • Sample

    230822-lg1llabd82

  • MD5

    349303758a146e6dd521f2728fc350ae

  • SHA1

    9d1ed58e9742b1543939d933aa9ba35893d56eea

  • SHA256

    9af51dc0660455ffba599c9d6206cdf5a82d5678d1b9f39292f20fd30ba568c9

  • SHA512

    b97b30f6631f4a42f93ef00ea98aeee76c4e371df5bbd15c72299a22a4d4016a80a14c6e6db39e16bbc9391355ff3c3ca24ecd4a4e01fea99cd2338ad61c9abf

  • SSDEEP

    24576:+CwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH9:+CwsbCANnKXferL7Vwe/Gg0P+WhQj

Malware Config

Targets

    • Target

      9af51dc0660455ffba599c9d6206cdf5a82d5678d1b9f39292f20fd30ba568c9

    • Size

      2.4MB

    • MD5

      349303758a146e6dd521f2728fc350ae

    • SHA1

      9d1ed58e9742b1543939d933aa9ba35893d56eea

    • SHA256

      9af51dc0660455ffba599c9d6206cdf5a82d5678d1b9f39292f20fd30ba568c9

    • SHA512

      b97b30f6631f4a42f93ef00ea98aeee76c4e371df5bbd15c72299a22a4d4016a80a14c6e6db39e16bbc9391355ff3c3ca24ecd4a4e01fea99cd2338ad61c9abf

    • SSDEEP

      24576:+CwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH9:+CwsbCANnKXferL7Vwe/Gg0P+WhQj

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Sets DLL path for service in the registry

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks