General

  • Target

    bfd1ebb16983f1ec9704044407510725417d82ead2ea403a02d5dbc307fdf9a1

  • Size

    1.3MB

  • Sample

    240625-we15fstfqg

  • MD5

    97272ad2b20a3ec5d66c178c9cce4b91

  • SHA1

    f00bf95531163c1b830698a36eaa703eb7c34ae2

  • SHA256

    bfd1ebb16983f1ec9704044407510725417d82ead2ea403a02d5dbc307fdf9a1

  • SHA512

    dca69773048ffbb750ab26014cece5c30c88871f35f9bd0586525adad1c329038875d9eb6bd70c2134f62fe1ec20baa63bd6c89cad8e2f0feb9b2729f92d3b14

  • SSDEEP

    24576:xQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVDZrv:xQZAdVyVT9n/Gg0P+Who6Z

Malware Config

Targets

    • Target

      bfd1ebb16983f1ec9704044407510725417d82ead2ea403a02d5dbc307fdf9a1

    • Size

      1.3MB

    • MD5

      97272ad2b20a3ec5d66c178c9cce4b91

    • SHA1

      f00bf95531163c1b830698a36eaa703eb7c34ae2

    • SHA256

      bfd1ebb16983f1ec9704044407510725417d82ead2ea403a02d5dbc307fdf9a1

    • SHA512

      dca69773048ffbb750ab26014cece5c30c88871f35f9bd0586525adad1c329038875d9eb6bd70c2134f62fe1ec20baa63bd6c89cad8e2f0feb9b2729f92d3b14

    • SSDEEP

      24576:xQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVDZrv:xQZAdVyVT9n/Gg0P+Who6Z

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks