General

  • Target

    f862bb4fcbe1eacc43072dd6311bcc984ebec4d46470e27bed6d52742dfd4efa

  • Size

    80KB

  • Sample

    230831-yrajdaab57

  • MD5

    f002c8fcab0c8aa869a0b474318dfdf1

  • SHA1

    ac54ce20dbf7575976bbdd530f7a7b753c1cc279

  • SHA256

    f862bb4fcbe1eacc43072dd6311bcc984ebec4d46470e27bed6d52742dfd4efa

  • SHA512

    62a894297dc043e764ea31aaa19832ac2dad95ef4c253d266fdb69327101aa54bd7f21dbd53b16573feba85cc62880b8be9d60229001688ae144ca67632be373

  • SSDEEP

    1536:bJEcqPbo9lxaLGF1E8xsG6Qw0cC6g6v66666ES66666E6kD66666E66gD66666Es:befbE51W0cC6g6v66666ES66666E6kDn

Malware Config

Targets

    • Target

      f862bb4fcbe1eacc43072dd6311bcc984ebec4d46470e27bed6d52742dfd4efa

    • Size

      80KB

    • MD5

      f002c8fcab0c8aa869a0b474318dfdf1

    • SHA1

      ac54ce20dbf7575976bbdd530f7a7b753c1cc279

    • SHA256

      f862bb4fcbe1eacc43072dd6311bcc984ebec4d46470e27bed6d52742dfd4efa

    • SHA512

      62a894297dc043e764ea31aaa19832ac2dad95ef4c253d266fdb69327101aa54bd7f21dbd53b16573feba85cc62880b8be9d60229001688ae144ca67632be373

    • SSDEEP

      1536:bJEcqPbo9lxaLGF1E8xsG6Qw0cC6g6v66666ES66666E6kD66666E66gD66666Es:befbE51W0cC6g6v66666ES66666E6kDn

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks