General

  • Target

    b2bcc1df66bff9f806900ff241c074807b795ca6129a2933c3918524ff59d7d6

  • Size

    1.3MB

  • Sample

    240317-vgtbysag74

  • MD5

    1a27efe140f94e5bea191ed296804e65

  • SHA1

    669978e97a43c08d28cd5a4f5502c4e285690918

  • SHA256

    b2bcc1df66bff9f806900ff241c074807b795ca6129a2933c3918524ff59d7d6

  • SHA512

    53ee4a1022b7c216451877c63192088b4088e0489156f19c206981c31796aece36e861dfa04624da1f8a4cf0758a8c32c13896de3a10c54d57b1fe3bcae156c4

  • SSDEEP

    24576:yTRRgkObgBSIigbHM3meDpJ4KmxwdbosrzSmK0a9MxlED6GcqA8JhAcWLheD/:yTznnigj5eVJ4KmxqSmKf9MxlE6G1ZA3

Malware Config

Targets

    • Target

      b2bcc1df66bff9f806900ff241c074807b795ca6129a2933c3918524ff59d7d6

    • Size

      1.3MB

    • MD5

      1a27efe140f94e5bea191ed296804e65

    • SHA1

      669978e97a43c08d28cd5a4f5502c4e285690918

    • SHA256

      b2bcc1df66bff9f806900ff241c074807b795ca6129a2933c3918524ff59d7d6

    • SHA512

      53ee4a1022b7c216451877c63192088b4088e0489156f19c206981c31796aece36e861dfa04624da1f8a4cf0758a8c32c13896de3a10c54d57b1fe3bcae156c4

    • SSDEEP

      24576:yTRRgkObgBSIigbHM3meDpJ4KmxwdbosrzSmK0a9MxlED6GcqA8JhAcWLheD/:yTznnigj5eVJ4KmxqSmKf9MxlE6G1ZA3

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks