Overview

overview

10

Static

static

3

0adf4c77e1...9d.exe

windows7-x64

10

0adf4c77e1...9d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0adf4c77e1d2b6a48648ef3f076bae85a8e60932591845a4bffcb8badde7ef9d

  • Size

    4.2MB

  • Sample

    240523-j9dlesaf57

  • MD5

    222ec7066dad63cc98579b8cc9c5afaf

  • SHA1

    45c3186699fcb3e1a277046a800b9afb3a7fcf25

  • SHA256

    0adf4c77e1d2b6a48648ef3f076bae85a8e60932591845a4bffcb8badde7ef9d

  • SHA512

    f236684f82f42efaa41c2c114c3d3aa35a900e8d1da6ecd7f0aff6681fd0d0fd815e339498fdf3927fdaab315d59962a355b0b8f2fd24ba1ccac99a24effc562

  • SSDEEP

    49152:S09XJt4HIN2H2tFvduySt4bXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8bU:zZJt4HINy2LkSbXsPN5kiQaZ56

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      0adf4c77e1d2b6a48648ef3f076bae85a8e60932591845a4bffcb8badde7ef9d

    • Size

      4.2MB

    • MD5

      222ec7066dad63cc98579b8cc9c5afaf

    • SHA1

      45c3186699fcb3e1a277046a800b9afb3a7fcf25

    • SHA256

      0adf4c77e1d2b6a48648ef3f076bae85a8e60932591845a4bffcb8badde7ef9d

    • SHA512

      f236684f82f42efaa41c2c114c3d3aa35a900e8d1da6ecd7f0aff6681fd0d0fd815e339498fdf3927fdaab315d59962a355b0b8f2fd24ba1ccac99a24effc562

    • SSDEEP

      49152:S09XJt4HIN2H2tFvduySt4bXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8bU:zZJt4HINy2LkSbXsPN5kiQaZ56

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks