General
- Target 986977afb2d34006eda18dc477782a77fdaa7e81e321056cf65d827beac0cbc0
- Size 8.1MB
- Sample240625-plndlszbmg
- SHA256 986977afb2d34006eda18dc477782a77fdaa7e81e321056cf65d827beac0cbc0
Score
10/10
Malware Config
Targets
-
- Target 986977afb2d34006eda18dc477782a77fdaa7e81e321056cf65d827beac0cbc0
- Size 8.1MB
- SHA256 986977afb2d34006eda18dc477782a77fdaa7e81e321056cf65d827beac0cbc0
Score10/10Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
Gh0st RAT payload
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Drops file in Drivers directory
Server Software Component: Terminal Services DLL
Sets service image path in registry
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Executes dropped EXE
Loads dropped DLL
Themida packer
Detects Themida, an advanced Windows software protection system.
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Checks whether UAC is enabled
Drops desktop.ini file(s)
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1