Overview

overview

10

Static

static

3

eec495f462...6b.exe

windows7-x64

10

eec495f462...6b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eec495f4620d67ae6638dfb270c4a870e63f44138dc20dd5a861df728ea64c6b

  • Size

    4.2MB

  • Sample

    240526-m2b96sfg8t

  • MD5

    1bc6b4bd5db3a67ca50ac4848ec5c212

  • SHA1

    804567ff1a8b371ae666447d3a9b0a0c80eeadd3

  • SHA256

    eec495f4620d67ae6638dfb270c4a870e63f44138dc20dd5a861df728ea64c6b

  • SHA512

    e7c415f669d6e811c9def16ab9894273f590b9741e941fc0cac12be09557970f3aef323b9d0808a5be0a9ea9f61dffc9ce9e692f8c58775d061f35cd605e7949

  • SSDEEP

    49152:OCwsbCANnKXferL7Vwe/Gg0P+WhNPHuXf1zQNH1pYbhq3jjsLWrISgwTalm:pws2ANnKXOaeOgmh5OXfAAbmjjCoISgu

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      eec495f4620d67ae6638dfb270c4a870e63f44138dc20dd5a861df728ea64c6b

    • Size

      4.2MB

    • MD5

      1bc6b4bd5db3a67ca50ac4848ec5c212

    • SHA1

      804567ff1a8b371ae666447d3a9b0a0c80eeadd3

    • SHA256

      eec495f4620d67ae6638dfb270c4a870e63f44138dc20dd5a861df728ea64c6b

    • SHA512

      e7c415f669d6e811c9def16ab9894273f590b9741e941fc0cac12be09557970f3aef323b9d0808a5be0a9ea9f61dffc9ce9e692f8c58775d061f35cd605e7949

    • SSDEEP

      49152:OCwsbCANnKXferL7Vwe/Gg0P+WhNPHuXf1zQNH1pYbhq3jjsLWrISgwTalm:pws2ANnKXOaeOgmh5OXfAAbmjjCoISgu

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks