General

  • Target

    94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c

  • Size

    1.3MB

  • Sample

    240618-lmk34axgnc

  • MD5

    4e2fe8d8ace83fc0f7d943e412e0a25f

  • SHA1

    9dba5ae7134880abd25eae481e1fd3f2e3b8bcbd

  • SHA256

    94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c

  • SHA512

    8c2097d4aff23adc23a30934e39c7b69cd271b48102d04e6211e8bfb1571bfbaaba3490c27e9dfdee6b669d7080cdc08409b95979089ba271e2be6889b33e9bd

  • SSDEEP

    24576:MOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNJ:9HPkVOBTK

Malware Config

Targets

    • Target

      94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c

    • Size

      1.3MB

    • MD5

      4e2fe8d8ace83fc0f7d943e412e0a25f

    • SHA1

      9dba5ae7134880abd25eae481e1fd3f2e3b8bcbd

    • SHA256

      94537143b04be62b1009a66f2f7b817007f6bab197ea302cc50bcc2ff8ea854c

    • SHA512

      8c2097d4aff23adc23a30934e39c7b69cd271b48102d04e6211e8bfb1571bfbaaba3490c27e9dfdee6b669d7080cdc08409b95979089ba271e2be6889b33e9bd

    • SSDEEP

      24576:MOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNJ:9HPkVOBTK

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Sets service image path in registry

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Discovery

Remote System Discovery

1
T1018

Tasks