Overview

overview

10

Static

static

3

fb8b6ddcba...ad.exe

windows7-x64

10

fb8b6ddcba...ad.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fb8b6ddcba059053f32528f21b41704232fa0b78a14cf4ad3e8ce9482514abad

  • Size

    6.7MB

  • Sample

    240625-s1dphayaqg

  • MD5

    778c0eda06b531eb5a5f862114a7d111

  • SHA1

    4a0a7b1a225bbf15449647a6666dccb756f4b417

  • SHA256

    fb8b6ddcba059053f32528f21b41704232fa0b78a14cf4ad3e8ce9482514abad

  • SHA512

    168ec70476b01c80979685b66576a2803e82667b75210612c6efed2b9475de2b9f65150588ee88afa44152a60bcf1bd1cb274fd8c6f07f02065070efd0b44499

  • SSDEEP

    98304:lGdVyVT9nOgmhUXXEgUvUTHc8eVuuquRNREHp/0rSKsAv:SWT9nO76X5JEN6J+t

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      fb8b6ddcba059053f32528f21b41704232fa0b78a14cf4ad3e8ce9482514abad

    • Size

      6.7MB

    • MD5

      778c0eda06b531eb5a5f862114a7d111

    • SHA1

      4a0a7b1a225bbf15449647a6666dccb756f4b417

    • SHA256

      fb8b6ddcba059053f32528f21b41704232fa0b78a14cf4ad3e8ce9482514abad

    • SHA512

      168ec70476b01c80979685b66576a2803e82667b75210612c6efed2b9475de2b9f65150588ee88afa44152a60bcf1bd1cb274fd8c6f07f02065070efd0b44499

    • SSDEEP

      98304:lGdVyVT9nOgmhUXXEgUvUTHc8eVuuquRNREHp/0rSKsAv:SWT9nO76X5JEN6J+t

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

      persistence

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks