Overview

overview

10

Static

static

3

de9815383e...d5.exe

windows7-x64

10

de9815383e...d5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    de9815383e99328a86cfe6a0a486db836ebe26c33b1ace04b28e5a24045ce1d5

  • Size

    11.8MB

  • Sample

    240525-qyspjaeh38

  • MD5

    c726ded62cbc33d84ca6cfd9dd545a2a

  • SHA1

    5001b52e7bafaff4af507cf52557b550511e0d63

  • SHA256

    de9815383e99328a86cfe6a0a486db836ebe26c33b1ace04b28e5a24045ce1d5

  • SHA512

    cfa9016d46ca3c96ad6e75af47ed7c8144e223aca599ce1ade59a5961986e766ea48f35c611a5e1fdebd40e8859e5a4aeade718e8f144984dc41d51c2dd7b49e

  • SSDEEP

    196608:viIZO7UdXu89wA4QNwKuYcBV8q1fNb4Dn51SOUv92GczYGjYlpvxuC5jVkjI2096:a7oeEw9QN2YC9uDKfv95NllxnAi9Fmdv

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      de9815383e99328a86cfe6a0a486db836ebe26c33b1ace04b28e5a24045ce1d5

    • Size

      11.8MB

    • MD5

      c726ded62cbc33d84ca6cfd9dd545a2a

    • SHA1

      5001b52e7bafaff4af507cf52557b550511e0d63

    • SHA256

      de9815383e99328a86cfe6a0a486db836ebe26c33b1ace04b28e5a24045ce1d5

    • SHA512

      cfa9016d46ca3c96ad6e75af47ed7c8144e223aca599ce1ade59a5961986e766ea48f35c611a5e1fdebd40e8859e5a4aeade718e8f144984dc41d51c2dd7b49e

    • SSDEEP

      196608:viIZO7UdXu89wA4QNwKuYcBV8q1fNb4Dn51SOUv92GczYGjYlpvxuC5jVkjI2096:a7oeEw9QN2YC9uDKfv95NllxnAi9Fmdv

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks