General

  • Target

    cae00bb02e283ed3c75bb9521db153841e735dd72231c863107289869a23c5bf

  • Size

    2.3MB

  • Sample

    240604-jbpwssaa57

  • MD5

    85a4cfcacf6357f95f680d7c5d296a10

  • SHA1

    7a2693ecb8439ef660515a6f631939f0c5b3cd63

  • SHA256

    cae00bb02e283ed3c75bb9521db153841e735dd72231c863107289869a23c5bf

  • SHA512

    48b5abdf01e440e29d1efe9aeca5f8c3d99a7b8268c942c402a343eb343d9518ab859ca6394c6748a6ba32e03d64fc3ad1b2798c5aa96dd886c34c1a7fb69899

  • SSDEEP

    49152:yQZAdVyVT9n/Gg0P+Who+yn2xE/3ObGHB3x:rGdVyVT9nOgmhbyn2xE2bGHBh

Malware Config

Targets

    • Target

      cae00bb02e283ed3c75bb9521db153841e735dd72231c863107289869a23c5bf

    • Size

      2.3MB

    • MD5

      85a4cfcacf6357f95f680d7c5d296a10

    • SHA1

      7a2693ecb8439ef660515a6f631939f0c5b3cd63

    • SHA256

      cae00bb02e283ed3c75bb9521db153841e735dd72231c863107289869a23c5bf

    • SHA512

      48b5abdf01e440e29d1efe9aeca5f8c3d99a7b8268c942c402a343eb343d9518ab859ca6394c6748a6ba32e03d64fc3ad1b2798c5aa96dd886c34c1a7fb69899

    • SSDEEP

      49152:yQZAdVyVT9n/Gg0P+Who+yn2xE/3ObGHB3x:rGdVyVT9nOgmhbyn2xE2bGHBh

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Sets DLL path for service in the registry

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Tasks