Analysis
-
max time kernel
138s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
03/10/2023, 15:55
General
-
Target
97a1cd49fa99eacd97ab69dd273b85113646d4ce6ea2cecaae131bac50d3751f.exe
-
Size
370KB
-
MD5
9e2ebe64684fdb7e89cf70337987e010
-
SHA1
e93512b2959acbc49ce8ceacf1f47cc1e754e2b1
-
SHA256
97a1cd49fa99eacd97ab69dd273b85113646d4ce6ea2cecaae131bac50d3751f
-
SHA512
269ca4c90964ed1be3fc14d1113ae6b213ae45d7fb78c9dd1944fb96420e01b0e0b9fbc38175fdffcbdce52eca8ae23565b63a38834420dd019ffb8a465fcf2c
-
SSDEEP
6144:q46iVZNa86sqSp5YEi68dBjYkOhDgAf3AQH0Qsay50v76GqYU20C:q45KST2vYkOhDX0Zz5S7689
Malware Config
Signatures
-
Detect PurpleFox Rootkit 3 IoCs
Detect PurpleFox Rootkit.
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\97a1cd49fa99eacd97ab69dd273b85113646d4ce6ea2cecaae131bac50d3751f.exe"C:\Users\Admin\AppData\Local\Temp\97a1cd49fa99eacd97ab69dd273b85113646d4ce6ea2cecaae131bac50d3751f.exe"1⤵
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB