Overview

overview

10

Static

static

3

bdb2d9d7a3...da.exe

windows7-x64

10

bdb2d9d7a3...da.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    bdb2d9d7a3c0e2969ceb0e6fdef9e20fac4a670a888c2e275ef9f60af03f50da

  • Size

    1.6MB

  • Sample

    240528-z42n3adh24

  • MD5

    619298ba8df564ed40161c0240970691

  • SHA1

    fce4dc50b825ebf77e589d0fd953e637e4abc161

  • SHA256

    bdb2d9d7a3c0e2969ceb0e6fdef9e20fac4a670a888c2e275ef9f60af03f50da

  • SHA512

    ae919c008b6182fd1688a4eb1217b6fe24901f8bd07845ccd873c7336e7a4f276ceb35e77b699dfb012ff121bd5016232cd0312ea71844d9eedb13a913c48c94

  • SSDEEP

    24576:PQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVQu0PQV1Dfun2k:PQZAdVyVT9n/Gg0P+WhovUDmn2k

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      bdb2d9d7a3c0e2969ceb0e6fdef9e20fac4a670a888c2e275ef9f60af03f50da

    • Size

      1.6MB

    • MD5

      619298ba8df564ed40161c0240970691

    • SHA1

      fce4dc50b825ebf77e589d0fd953e637e4abc161

    • SHA256

      bdb2d9d7a3c0e2969ceb0e6fdef9e20fac4a670a888c2e275ef9f60af03f50da

    • SHA512

      ae919c008b6182fd1688a4eb1217b6fe24901f8bd07845ccd873c7336e7a4f276ceb35e77b699dfb012ff121bd5016232cd0312ea71844d9eedb13a913c48c94

    • SSDEEP

      24576:PQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVQu0PQV1Dfun2k:PQZAdVyVT9n/Gg0P+WhovUDmn2k

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks