General

  • Target

    635e655929b69e97bcf8257cebbe90cf26cc72e5587bfd5bccf598f9705806f9

  • Size

    1.3MB

  • Sample

    240317-lzndzscd2v

  • MD5

    4fdbfa79688eefb696b3a3069dec8e47

  • SHA1

    52c3d327d96157a6bee87d9a042035837d36bdc2

  • SHA256

    635e655929b69e97bcf8257cebbe90cf26cc72e5587bfd5bccf598f9705806f9

  • SHA512

    850bbe8989a2c7a766a8455e1f1a749b3cf28f58a00775ade83050b3a2a6f5e596b2c560dd48adc0104fb1dddf2539e2e98c21a01255276f41d77140b455c7f9

  • SSDEEP

    24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMN6:QHPkVOBTK

Malware Config

Targets

    • Target

      635e655929b69e97bcf8257cebbe90cf26cc72e5587bfd5bccf598f9705806f9

    • Size

      1.3MB

    • MD5

      4fdbfa79688eefb696b3a3069dec8e47

    • SHA1

      52c3d327d96157a6bee87d9a042035837d36bdc2

    • SHA256

      635e655929b69e97bcf8257cebbe90cf26cc72e5587bfd5bccf598f9705806f9

    • SHA512

      850bbe8989a2c7a766a8455e1f1a749b3cf28f58a00775ade83050b3a2a6f5e596b2c560dd48adc0104fb1dddf2539e2e98c21a01255276f41d77140b455c7f9

    • SSDEEP

      24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMN6:QHPkVOBTK

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Sets service image path in registry

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks