Overview

overview

10

Static

static

3

a659862267...14.exe

windows7-x64

10

a659862267...14.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a6598622671b78f6b69047d4919b2106ae9af3c9dd4337a3766bc8461f8f7114

  • Size

    2.2MB

  • Sample

    240123-c233safafj

  • MD5

    6c7e4ce53089162d31b4f2a6aff9e327

  • SHA1

    b8738a7dbf227640910fde6a3e2de0a91f3c19c6

  • SHA256

    a6598622671b78f6b69047d4919b2106ae9af3c9dd4337a3766bc8461f8f7114

  • SHA512

    904639e800eebfeff43125c8276459f092b7669997b581fa7ba2004a6c67ae4e3e7fc9978d31ceec6f43d8b180870a79c833beae8e0a821a3c70b3a909027b35

  • SSDEEP

    24576:P09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+nAvBj/4ZT:P09XJt4HIN2H2tFvduySux/0

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      a6598622671b78f6b69047d4919b2106ae9af3c9dd4337a3766bc8461f8f7114

    • Size

      2.2MB

    • MD5

      6c7e4ce53089162d31b4f2a6aff9e327

    • SHA1

      b8738a7dbf227640910fde6a3e2de0a91f3c19c6

    • SHA256

      a6598622671b78f6b69047d4919b2106ae9af3c9dd4337a3766bc8461f8f7114

    • SHA512

      904639e800eebfeff43125c8276459f092b7669997b581fa7ba2004a6c67ae4e3e7fc9978d31ceec6f43d8b180870a79c833beae8e0a821a3c70b3a909027b35

    • SSDEEP

      24576:P09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+nAvBj/4ZT:P09XJt4HIN2H2tFvduySux/0

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks