General

  • Target

    14f10a6f798429539f61566a6ee62239e23b15657e6839604c979d7b1a4f1e54

  • Size

    4.6MB

  • Sample

    240624-2p8j6syhmk

  • MD5

    27644408324d5b3726facb91d14977d9

  • SHA1

    6c970d637467120672d1c96acbd3a5a1cebd6775

  • SHA256

    14f10a6f798429539f61566a6ee62239e23b15657e6839604c979d7b1a4f1e54

  • SHA512

    f068583021fb52e937bd9b7cb41bd34e911af4d42f55fe3f6e21a86870070753bf7d2fa3cde5cbf3447adbceec4cbef7fb1b57811988206fab9770b87aab5e41

  • SSDEEP

    49152:909XJt4HIN2H2tFvduySTGbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8bU:eZJt4HINy2LkTGbXsPN5kiQaZ56

Malware Config

Targets

    • Target

      14f10a6f798429539f61566a6ee62239e23b15657e6839604c979d7b1a4f1e54

    • Size

      4.6MB

    • MD5

      27644408324d5b3726facb91d14977d9

    • SHA1

      6c970d637467120672d1c96acbd3a5a1cebd6775

    • SHA256

      14f10a6f798429539f61566a6ee62239e23b15657e6839604c979d7b1a4f1e54

    • SHA512

      f068583021fb52e937bd9b7cb41bd34e911af4d42f55fe3f6e21a86870070753bf7d2fa3cde5cbf3447adbceec4cbef7fb1b57811988206fab9770b87aab5e41

    • SSDEEP

      49152:909XJt4HIN2H2tFvduySTGbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8bU:eZJt4HINy2LkTGbXsPN5kiQaZ56

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Tasks