Overview

overview

10

Static

static

3

f17ddcd71a...24.exe

windows7-x64

10

f17ddcd71a...24.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f17ddcd71a70ffbd58debea2f642d87a58a3b8f8bc529ddf7a725db1ec102124

  • Size

    1.1MB

  • Sample

    240525-v5czwaca3y

  • MD5

    62c7f27e9d202754c555e13f0815cce1

  • SHA1

    437a94ba4ecee98c02b170417d62f9a48661340e

  • SHA256

    f17ddcd71a70ffbd58debea2f642d87a58a3b8f8bc529ddf7a725db1ec102124

  • SHA512

    b47b10d0a00eb7f38553401d8d932b5d65afd9045052b6e216cb1fe70cd752cb44244fe4be4b072388199468d448abcf4f8f42e8aa4481eff63fb75547b19647

  • SSDEEP

    24576:f09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+ewper:f09XJt4HIN2H2tFvduySnper

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      f17ddcd71a70ffbd58debea2f642d87a58a3b8f8bc529ddf7a725db1ec102124

    • Size

      1.1MB

    • MD5

      62c7f27e9d202754c555e13f0815cce1

    • SHA1

      437a94ba4ecee98c02b170417d62f9a48661340e

    • SHA256

      f17ddcd71a70ffbd58debea2f642d87a58a3b8f8bc529ddf7a725db1ec102124

    • SHA512

      b47b10d0a00eb7f38553401d8d932b5d65afd9045052b6e216cb1fe70cd752cb44244fe4be4b072388199468d448abcf4f8f42e8aa4481eff63fb75547b19647

    • SSDEEP

      24576:f09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+ewper:f09XJt4HIN2H2tFvduySnper

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks