Overview

overview

10

Static

static

3

6022db0843...48.exe

windows7-x64

10

6022db0843...48.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6022db0843ddff3ac8c0b50d7e9a55af413e36efb7990947498c717255bd5148

  • Size

    2.4MB

  • Sample

    240526-etp73afc54

  • MD5

    aed05b75b0d1e1bf434d93f096884deb

  • SHA1

    bbd459975cfe2743b522b80a9c13f5e941631f3c

  • SHA256

    6022db0843ddff3ac8c0b50d7e9a55af413e36efb7990947498c717255bd5148

  • SHA512

    48b89b5ea524e5f623425e5805f5cad12a8f9b124fb1a6b779e4ebfad127bf1d6b85acd0b0f5e8fe24e6fb801ffecd1d06c1690166ea07488b9fc61db04c0cd0

  • SSDEEP

    24576:tCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHh:tCwsbCANnKXferL7Vwe/Gg0P+WhDOiC

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      6022db0843ddff3ac8c0b50d7e9a55af413e36efb7990947498c717255bd5148

    • Size

      2.4MB

    • MD5

      aed05b75b0d1e1bf434d93f096884deb

    • SHA1

      bbd459975cfe2743b522b80a9c13f5e941631f3c

    • SHA256

      6022db0843ddff3ac8c0b50d7e9a55af413e36efb7990947498c717255bd5148

    • SHA512

      48b89b5ea524e5f623425e5805f5cad12a8f9b124fb1a6b779e4ebfad127bf1d6b85acd0b0f5e8fe24e6fb801ffecd1d06c1690166ea07488b9fc61db04c0cd0

    • SSDEEP

      24576:tCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHh:tCwsbCANnKXferL7Vwe/Gg0P+WhDOiC

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks