Overview

overview

10

Static

static

3

f942956ffa...18.exe

windows7-x64

10

f942956ffa...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f942956ffac38563397fbbfafe59e54a_JaffaCakes118

  • Size

    1.6MB

  • Sample

    240419-cfz41aeg5t

  • MD5

    f942956ffac38563397fbbfafe59e54a

  • SHA1

    0669b5e54ecf3a2942318f58bf1f49d7dcac778b

  • SHA256

    c0c8832851b0ee102b875741ff90391469c8b097193dfb9aa870f6b7fe7943b7

  • SHA512

    2acf66b49e1830f170ad1527817ce1c7155d84edf44549f35383c18edd57ddfed272f0ba4bcb472a9cd64fd396420c7b7c28c28ad856f6b395c1950c786e1fb7

  • SSDEEP

    24576:23WXkYOAcwnBXo0vnsH6xY1Kkog2G8LoxqCwSISp5t9T5oI:23WX9cao+saxY1Kkog2GKNCN5t9TWI

Score
10/10
gh0stratpurplefoxratrootkittrojan

Malware Config

Targets

    • Target

      f942956ffac38563397fbbfafe59e54a_JaffaCakes118

    • Size

      1.6MB

    • MD5

      f942956ffac38563397fbbfafe59e54a

    • SHA1

      0669b5e54ecf3a2942318f58bf1f49d7dcac778b

    • SHA256

      c0c8832851b0ee102b875741ff90391469c8b097193dfb9aa870f6b7fe7943b7

    • SHA512

      2acf66b49e1830f170ad1527817ce1c7155d84edf44549f35383c18edd57ddfed272f0ba4bcb472a9cd64fd396420c7b7c28c28ad856f6b395c1950c786e1fb7

    • SSDEEP

      24576:23WXkYOAcwnBXo0vnsH6xY1Kkog2G8LoxqCwSISp5t9T5oI:23WX9cao+saxY1Kkog2GKNCN5t9TWI

    Score
    10/10
    gh0stratpurplefoxratrootkittrojan

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks