Overview

overview

10

Static

static

3

bf77a4207c...23.exe

windows7-x64

10

bf77a4207c...23.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf77a4207ce01394db927bd6c6292a314a5e6d7ad419663d8b2beb544cdcdf23

  • Size

    5.4MB

  • Sample

    240526-jkj2xabe7t

  • MD5

    9675bfbd17ccb44aacd0b42deac9b944

  • SHA1

    958e719a750fd71a0ff7f87e46a5b8f744c2f443

  • SHA256

    bf77a4207ce01394db927bd6c6292a314a5e6d7ad419663d8b2beb544cdcdf23

  • SHA512

    14e8d4d17ca167e78487066283a9518082fcb84f675d40e2c4403e4074b9d48f30ac3cc71a84bb978c246645f58f30f6681efbee4a79ef224022d862704f03d5

  • SSDEEP

    98304:ocy2Lk/nlEKfVkkbThYZeQzufTfHnI4p0ZnDqdE8UvsydI3iLcelaFAP52vKqnaU:Jy2Lk/nlEQV1vhYQQzmTHnITZn2UvsSK

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupxvmprotect

Malware Config

Targets

    • Target

      bf77a4207ce01394db927bd6c6292a314a5e6d7ad419663d8b2beb544cdcdf23

    • Size

      5.4MB

    • MD5

      9675bfbd17ccb44aacd0b42deac9b944

    • SHA1

      958e719a750fd71a0ff7f87e46a5b8f744c2f443

    • SHA256

      bf77a4207ce01394db927bd6c6292a314a5e6d7ad419663d8b2beb544cdcdf23

    • SHA512

      14e8d4d17ca167e78487066283a9518082fcb84f675d40e2c4403e4074b9d48f30ac3cc71a84bb978c246645f58f30f6681efbee4a79ef224022d862704f03d5

    • SSDEEP

      98304:ocy2Lk/nlEKfVkkbThYZeQzufTfHnI4p0ZnDqdE8UvsydI3iLcelaFAP52vKqnaU:Jy2Lk/nlEQV1vhYQQzmTHnITZn2UvsSK

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupxvmprotect

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks