General
-
Target
11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986
-
Size
2.9MB
-
Sample
240526-q7kqaahe64
-
MD5
0b8aa616bcc8c9c27924c79ead14d089
-
SHA1
4b271ae81d4e9340d91c433c682029b3c588cc60
-
SHA256
11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986
-
SHA512
19f434716a4baf845a6074f54a76cc395ffa984e37dc8dfb59ae6222ae503b2f6423a66b18d8ff2b1841e1df096d9f11a60347ae903b14307959a74475297e31
-
SSDEEP
49152:k09XJt4HIN2H2tFvduyShspoZ/Pjb6Kt0rbJEuSLz5xXA:JZJt4HINy2LkhsqZ6K+mLzA
Malware Config
Targets
-
-
Target
11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986
-
Size
2.9MB
-
MD5
0b8aa616bcc8c9c27924c79ead14d089
-
SHA1
4b271ae81d4e9340d91c433c682029b3c588cc60
-
SHA256
11a1500328b0747c8c6116bb943c034a8a685def49e820e6441a774a1b401986
-
SHA512
19f434716a4baf845a6074f54a76cc395ffa984e37dc8dfb59ae6222ae503b2f6423a66b18d8ff2b1841e1df096d9f11a60347ae903b14307959a74475297e31
-
SSDEEP
49152:k09XJt4HIN2H2tFvduyShspoZ/Pjb6Kt0rbJEuSLz5xXA:JZJt4HINy2LkhsqZ6K+mLzA
Score10/10-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Drops file in Drivers directory
-
Sets service image path in registry
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-