General

  • Target

    6c3b5a51ed53a3c3f0c429e252e6b754d8de620b6bddcd5b418ade39e94c65a2

  • Size

    2.4MB

  • Sample

    240529-gyps7sch9t

  • MD5

    3d5ea099fc9a80eecb48b6175817c284

  • SHA1

    7a98c3e7d8756a6d7d9076fdbc14257bfce59c20

  • SHA256

    6c3b5a51ed53a3c3f0c429e252e6b754d8de620b6bddcd5b418ade39e94c65a2

  • SHA512

    d093441295bbc7225aceb68931c8039f268ea794aac35943b8fe96abd8e2c75a98d2d6452cd9f8abb40db599dd2590d0508ed270d4bbe4f269e90af88435e452

  • SSDEEP

    49152:RCwsbCANnKXferL7Vwe/Gg0P+WhhJWJJsxDI:cws2ANnKXOaeOgmhhJWJJsxc

Malware Config

Targets

    • Target

      6c3b5a51ed53a3c3f0c429e252e6b754d8de620b6bddcd5b418ade39e94c65a2

    • Size

      2.4MB

    • MD5

      3d5ea099fc9a80eecb48b6175817c284

    • SHA1

      7a98c3e7d8756a6d7d9076fdbc14257bfce59c20

    • SHA256

      6c3b5a51ed53a3c3f0c429e252e6b754d8de620b6bddcd5b418ade39e94c65a2

    • SHA512

      d093441295bbc7225aceb68931c8039f268ea794aac35943b8fe96abd8e2c75a98d2d6452cd9f8abb40db599dd2590d0508ed270d4bbe4f269e90af88435e452

    • SSDEEP

      49152:RCwsbCANnKXferL7Vwe/Gg0P+WhhJWJJsxDI:cws2ANnKXOaeOgmhhJWJJsxc

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Sets DLL path for service in the registry

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Tasks