General

  • Target

    cff6154c2eea64158bff3a9f3d4420f15cb6a051405836bddcee5ea1ea75a79c

  • Size

    6.6MB

  • Sample

    240625-xtl5hsxdje

  • MD5

    9ec1922fa9f60b1281e77232e74fe7be

  • SHA1

    f95d1ef0dc8da20fbf4a809e6aad1d6a2e6bbb80

  • SHA256

    cff6154c2eea64158bff3a9f3d4420f15cb6a051405836bddcee5ea1ea75a79c

  • SHA512

    30c57c28530cc6d16f37e4c98e6cb5c773255194888e581206ae65bf360c27df6aad62fe528c099176941d3ae0943fb9c40a2a30ba5c234b4a277cadcff953d7

  • SSDEEP

    98304:nws2ANnKXOaeOgmhAPv7lx8hk2Od4kC50Cg7fANQHUqMbVjK:RKXbeO7evjexe2dqIm

Malware Config

Targets

    • Target

      cff6154c2eea64158bff3a9f3d4420f15cb6a051405836bddcee5ea1ea75a79c

    • Size

      6.6MB

    • MD5

      9ec1922fa9f60b1281e77232e74fe7be

    • SHA1

      f95d1ef0dc8da20fbf4a809e6aad1d6a2e6bbb80

    • SHA256

      cff6154c2eea64158bff3a9f3d4420f15cb6a051405836bddcee5ea1ea75a79c

    • SHA512

      30c57c28530cc6d16f37e4c98e6cb5c773255194888e581206ae65bf360c27df6aad62fe528c099176941d3ae0943fb9c40a2a30ba5c234b4a277cadcff953d7

    • SSDEEP

      98304:nws2ANnKXOaeOgmhAPv7lx8hk2Od4kC50Cg7fANQHUqMbVjK:RKXbeO7evjexe2dqIm

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks