General

  • Target

    9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e

  • Size

    1.5MB

  • Sample

    230829-2cnn8sbd81

  • MD5

    0b039deb607419f5bff838578e302eae

  • SHA1

    a9d2b9524b1947777fd5554ccd56825fc4cf1d30

  • SHA256

    9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e

  • SHA512

    910ec24860db2d6b618866a87447efd2be79dbfe3ce9dea599bd4a478b278d891c512aabcd77bf1c83461b76f553c51b1fb7e7522e4d1aef920f00e7cb245ee1

  • SSDEEP

    24576:j89tv9/7JtDElDEExIecl1erdg0MCiVWhR/K:j89XJt4HIZ/Gg0P+Wh0

Malware Config

Targets

    • Target

      9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e

    • Size

      1.5MB

    • MD5

      0b039deb607419f5bff838578e302eae

    • SHA1

      a9d2b9524b1947777fd5554ccd56825fc4cf1d30

    • SHA256

      9c45a2de80787b0d7c3bc0938ab2c7f009cf6f3ce292eaf60f5913b03e63ca3e

    • SHA512

      910ec24860db2d6b618866a87447efd2be79dbfe3ce9dea599bd4a478b278d891c512aabcd77bf1c83461b76f553c51b1fb7e7522e4d1aef920f00e7cb245ee1

    • SSDEEP

      24576:j89tv9/7JtDElDEExIecl1erdg0MCiVWhR/K:j89XJt4HIZ/Gg0P+Wh0

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks