Overview

overview

10

Static

static

3

f38d95f106...76.exe

windows7-x64

10

f38d95f106...76.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f38d95f10627da96a187e5da7588e1c76047537dc2fe5838b5b8dbc2d5e27676

  • Size

    9.7MB

  • Sample

    240526-qeba5sgb67

  • MD5

    c32b089eb0433ac08dcf2f69cb12de59

  • SHA1

    d2a6bbc3ec5284cd800849b0b55837de2aac9384

  • SHA256

    f38d95f10627da96a187e5da7588e1c76047537dc2fe5838b5b8dbc2d5e27676

  • SHA512

    9029a906510da87eeebfd859e0d94b044b703c61b5e727a0b9c847d82f88a9daf31d447f1be850b73068ca4d173d04285af9cf26d17bc1aa85c267f4ef67a43b

  • SSDEEP

    196608:ZKXbeO71PIRAzIs2zys0HSQFSqgWUgu5YmHf6Yq5:671AdTzh0bOWUPGmHf6p

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      f38d95f10627da96a187e5da7588e1c76047537dc2fe5838b5b8dbc2d5e27676

    • Size

      9.7MB

    • MD5

      c32b089eb0433ac08dcf2f69cb12de59

    • SHA1

      d2a6bbc3ec5284cd800849b0b55837de2aac9384

    • SHA256

      f38d95f10627da96a187e5da7588e1c76047537dc2fe5838b5b8dbc2d5e27676

    • SHA512

      9029a906510da87eeebfd859e0d94b044b703c61b5e727a0b9c847d82f88a9daf31d447f1be850b73068ca4d173d04285af9cf26d17bc1aa85c267f4ef67a43b

    • SSDEEP

      196608:ZKXbeO71PIRAzIs2zys0HSQFSqgWUgu5YmHf6Yq5:671AdTzh0bOWUPGmHf6p

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks