General

  • Target

    a95084f77b1e8e1d4a9362386d1c748bc3b281d98387cae97198348a24780f71

  • Size

    1.2MB

  • Sample

    230828-k6xqkaba94

  • MD5

    2a875505c556074543a6161c977f9306

  • SHA1

    cb6b5902f60e974683f635ad592ecb061a119c84

  • SHA256

    a95084f77b1e8e1d4a9362386d1c748bc3b281d98387cae97198348a24780f71

  • SHA512

    4d6493fcca3b36fc1697a4bf6a24bf13ef271eb18cfe59b2a0f1a908b14464959e510a04e83ee75a8439263469951bb40d38ce8ebf517c7eaa7d7166a88b28ff

  • SSDEEP

    24576:109tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+w:109XJt4HIN2H2tFvduySm

Malware Config

Targets

    • Target

      a95084f77b1e8e1d4a9362386d1c748bc3b281d98387cae97198348a24780f71

    • Size

      1.2MB

    • MD5

      2a875505c556074543a6161c977f9306

    • SHA1

      cb6b5902f60e974683f635ad592ecb061a119c84

    • SHA256

      a95084f77b1e8e1d4a9362386d1c748bc3b281d98387cae97198348a24780f71

    • SHA512

      4d6493fcca3b36fc1697a4bf6a24bf13ef271eb18cfe59b2a0f1a908b14464959e510a04e83ee75a8439263469951bb40d38ce8ebf517c7eaa7d7166a88b28ff

    • SSDEEP

      24576:109tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+w:109XJt4HIN2H2tFvduySm

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks