Malware Analysis Report

2025-01-02 15:23

Sample ID 240525-tt9zssad2z
Target 2276-7-0x0000000000400000-0x000000000233B000-memory.dmp
SHA256 94ccd38497eb752e75e752208e94b81adfc6504203ab47bf2e9f51e880161398
Tags
rootkit upx gh0strat purplefox
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

94ccd38497eb752e75e752208e94b81adfc6504203ab47bf2e9f51e880161398

Threat Level: Known bad

The file 2276-7-0x0000000000400000-0x000000000233B000-memory.dmp was found to be: Known bad.

Malicious Activity Summary

rootkit upx gh0strat purplefox

Detect PurpleFox Rootkit

Gh0st RAT payload

Gh0strat family

Purplefox family

UPX packed file

Unsigned PE

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-25 16:22

Signatures

Detect PurpleFox Rootkit

rootkit
Description Indicator Process Target
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Gh0strat family

gh0strat

Purplefox family

purplefox

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-25 16:22

Reported

2024-05-25 16:22

Platform

win7-20240508-en

Max time kernel

0s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-25 16:22

Reported

2024-05-25 16:22

Platform

win10v2004-20240426-en

Max time kernel

0s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A