Overview

overview

10

Static

static

3

41dfa56481...95.exe

windows7-x64

10

41dfa56481...95.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    41dfa56481cbd8544e2fa5e9b4bd24256252b07a29eb4dfced3a1dd31e50e495

  • Size

    2.0MB

  • Sample

    240526-rr4c5ahd9y

  • MD5

    ba58560bf1462e5ad2e85e4628c2a804

  • SHA1

    ed6b2390b51226c62c24dcfa0faede26f373a198

  • SHA256

    41dfa56481cbd8544e2fa5e9b4bd24256252b07a29eb4dfced3a1dd31e50e495

  • SHA512

    49d31d5f69432105375accc198851a6436258899781004eee7cd5aa27581fd7b915eb30f380c9e74e6b53132f1efbe9db8838dd0116e71f0d282309704391206

  • SSDEEP

    24576:I09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+5WyQYgBuAOGvaWXGY:I09XJt4HIN2H2tFvduySbgpJfp

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      41dfa56481cbd8544e2fa5e9b4bd24256252b07a29eb4dfced3a1dd31e50e495

    • Size

      2.0MB

    • MD5

      ba58560bf1462e5ad2e85e4628c2a804

    • SHA1

      ed6b2390b51226c62c24dcfa0faede26f373a198

    • SHA256

      41dfa56481cbd8544e2fa5e9b4bd24256252b07a29eb4dfced3a1dd31e50e495

    • SHA512

      49d31d5f69432105375accc198851a6436258899781004eee7cd5aa27581fd7b915eb30f380c9e74e6b53132f1efbe9db8838dd0116e71f0d282309704391206

    • SSDEEP

      24576:I09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+5WyQYgBuAOGvaWXGY:I09XJt4HIN2H2tFvduySbgpJfp

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks