Overview

overview

10

Static

static

3

897cf6db26...29.exe

windows7-x64

10

897cf6db26...29.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    897cf6db26a3ff14a3e85c0c050844cb87dd083028c8c84313a1da3595da2329

  • Size

    2.5MB

  • Sample

    240620-e58hsatcmm

  • MD5

    b2fef11cf1136b832f5ec58a50b57eb8

  • SHA1

    f306d0a9d223c1e425074bfad92571c0c309288a

  • SHA256

    897cf6db26a3ff14a3e85c0c050844cb87dd083028c8c84313a1da3595da2329

  • SHA512

    8c781ed370149c988359bc23fff44651221555aa1d549475b974d7aebbf354654a6680c6cb48be672f7413bdb25572c83e0fa2ae099e992dc02dc5836d57f306

  • SSDEEP

    24576:FCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHg:FCwsbCANnKXferL7Vwe/Gg0P+WhaG

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      897cf6db26a3ff14a3e85c0c050844cb87dd083028c8c84313a1da3595da2329

    • Size

      2.5MB

    • MD5

      b2fef11cf1136b832f5ec58a50b57eb8

    • SHA1

      f306d0a9d223c1e425074bfad92571c0c309288a

    • SHA256

      897cf6db26a3ff14a3e85c0c050844cb87dd083028c8c84313a1da3595da2329

    • SHA512

      8c781ed370149c988359bc23fff44651221555aa1d549475b974d7aebbf354654a6680c6cb48be672f7413bdb25572c83e0fa2ae099e992dc02dc5836d57f306

    • SSDEEP

      24576:FCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHg:FCwsbCANnKXferL7Vwe/Gg0P+WhaG

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

      persistence

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks