General

  • Target

    6fe2299d0c1e924beb438db0b8f1adb19ab20fb877ff9e8cd14a452bc8ea741a

  • Size

    4.8MB

  • Sample

    240319-m4es3sbb7v

  • MD5

    75ccb629c680c76df6466195b73cc12f

  • SHA1

    259b9dce4d871b249104e5e39d7433cc110d416d

  • SHA256

    6fe2299d0c1e924beb438db0b8f1adb19ab20fb877ff9e8cd14a452bc8ea741a

  • SHA512

    cf6c82e3ff69bffc5119173481c734359b6a1a134885858046229d52a8d453b09e163ebbd125d8d4da88390b5efd9b68da50d4996c71764c93e9ef2990c0787b

  • SSDEEP

    49152:pQZAdVyVT9n/Gg0P+WhoVJbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8bU:6GdVyVT9nOgmhWJbXsPN5kiQaZ56

Malware Config

Targets

    • Target

      6fe2299d0c1e924beb438db0b8f1adb19ab20fb877ff9e8cd14a452bc8ea741a

    • Size

      4.8MB

    • MD5

      75ccb629c680c76df6466195b73cc12f

    • SHA1

      259b9dce4d871b249104e5e39d7433cc110d416d

    • SHA256

      6fe2299d0c1e924beb438db0b8f1adb19ab20fb877ff9e8cd14a452bc8ea741a

    • SHA512

      cf6c82e3ff69bffc5119173481c734359b6a1a134885858046229d52a8d453b09e163ebbd125d8d4da88390b5efd9b68da50d4996c71764c93e9ef2990c0787b

    • SSDEEP

      49152:pQZAdVyVT9n/Gg0P+WhoVJbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8bU:6GdVyVT9nOgmhWJbXsPN5kiQaZ56

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Sets DLL path for service in the registry

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks