Overview

overview

10

Static

static

3

b7b673ddf4...f1.exe

windows7-x64

10

b7b673ddf4...f1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b7b673ddf46adbc5c9c7bd90073b5c67955ea012409ce0c648f4e2cdfecfaef1

  • Size

    2.8MB

  • Sample

    240526-ecqghaee66

  • MD5

    65a1b857deefd387b9ad6060a3012e13

  • SHA1

    91631b9b04c3d091503d55f5ff3032ae122f9e5c

  • SHA256

    b7b673ddf46adbc5c9c7bd90073b5c67955ea012409ce0c648f4e2cdfecfaef1

  • SHA512

    95f6af13491da2d63799095535d3013d72093697d14f9fcec355843095241bdd5fb6a2242620020bf53432deecc22a1fc5aa58d8223bcc5cbf7e5c4d6fe26dcc

  • SSDEEP

    49152:dCwsbCANnKXferL7Vwe/Gg0P+WhjlTjm21t:gws2ANnKXOaeOgmhjlt

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      b7b673ddf46adbc5c9c7bd90073b5c67955ea012409ce0c648f4e2cdfecfaef1

    • Size

      2.8MB

    • MD5

      65a1b857deefd387b9ad6060a3012e13

    • SHA1

      91631b9b04c3d091503d55f5ff3032ae122f9e5c

    • SHA256

      b7b673ddf46adbc5c9c7bd90073b5c67955ea012409ce0c648f4e2cdfecfaef1

    • SHA512

      95f6af13491da2d63799095535d3013d72093697d14f9fcec355843095241bdd5fb6a2242620020bf53432deecc22a1fc5aa58d8223bcc5cbf7e5c4d6fe26dcc

    • SSDEEP

      49152:dCwsbCANnKXferL7Vwe/Gg0P+WhjlTjm21t:gws2ANnKXOaeOgmhjlt

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks