Overview

overview

10

Static

static

1

file.lnk

windows7-x64

10

file.lnk

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.lnk

  • Size

    2KB

  • Sample

    230919-tddlnacb87

  • MD5

    b9c5bbb9e1c14a7d34087b9dab239a8c

  • SHA1

    c71c5c794d76c252c77eae881685108a0a01f5ee

  • SHA256

    2971aa6c623ae9f42fd06a7dcf166598857ff63548937ff663ca972bc40fd7c7

  • SHA512

    7c0ceb15bc72978264fb36810f3b01aae018423227b4edc0fee0321b6a487bfef3964e080a49e6d27099642a74d164d4b662929fb9405a45caacfaeeb89c5db2

Score
10/10
purplefoxdiscoveryevasionrootkittrojan

Malware Config

Targets

    • Target

      file.lnk

    • Size

      2KB

    • MD5

      b9c5bbb9e1c14a7d34087b9dab239a8c

    • SHA1

      c71c5c794d76c252c77eae881685108a0a01f5ee

    • SHA256

      2971aa6c623ae9f42fd06a7dcf166598857ff63548937ff663ca972bc40fd7c7

    • SHA512

      7c0ceb15bc72978264fb36810f3b01aae018423227b4edc0fee0321b6a487bfef3964e080a49e6d27099642a74d164d4b662929fb9405a45caacfaeeb89c5db2

    Score
    10/10
    purplefoxdiscoveryevasionrootkittrojan

    • Detect PurpleFox MSI

      Detect PurpleFox MSI.

      rootkit

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Blocklisted process makes network request

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Use of msiexec (install) with remote resource

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks