General

  • Target

    d6416024c6bd624486f19e7228fd1dc73ccdc23dec69d86eaa0fe5f532a85ac4

  • Size

    1.1MB

  • Sample

    230827-xmgapacf88

  • MD5

    a4566571a8ccfa29856f6bb019cc740f

  • SHA1

    6b8442ff44b846de2dbcfe5da76d7325ba0fc1a2

  • SHA256

    d6416024c6bd624486f19e7228fd1dc73ccdc23dec69d86eaa0fe5f532a85ac4

  • SHA512

    6c74d3bf39533f559cceeaa7bb3dcb1e85a51e9dfea4f47fe743d0e951f1cd6ebf809b0caaaf84cde995ed33a7ae747253df8859cb95dc13a0b87083744a5b17

  • SSDEEP

    24576:M09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+twpehs:M09XJt4HIN2H2tFvduyS0pehs

Malware Config

Targets

    • Target

      d6416024c6bd624486f19e7228fd1dc73ccdc23dec69d86eaa0fe5f532a85ac4

    • Size

      1.1MB

    • MD5

      a4566571a8ccfa29856f6bb019cc740f

    • SHA1

      6b8442ff44b846de2dbcfe5da76d7325ba0fc1a2

    • SHA256

      d6416024c6bd624486f19e7228fd1dc73ccdc23dec69d86eaa0fe5f532a85ac4

    • SHA512

      6c74d3bf39533f559cceeaa7bb3dcb1e85a51e9dfea4f47fe743d0e951f1cd6ebf809b0caaaf84cde995ed33a7ae747253df8859cb95dc13a0b87083744a5b17

    • SSDEEP

      24576:M09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+twpehs:M09XJt4HIN2H2tFvduyS0pehs

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks