General

  • Target

    259229f42a47ca11e24682e3ca520ffe2ce5da59c8088cd044645b50cf0c27f0

  • Size

    1.3MB

  • Sample

    240626-ghd2rs1dpm

  • MD5

    fda41840ee0f07f2ffed94a33fa3d1d0

  • SHA1

    52b504d779f56202018177d8fc7881916fef407a

  • SHA256

    259229f42a47ca11e24682e3ca520ffe2ce5da59c8088cd044645b50cf0c27f0

  • SHA512

    c984e3dc819510d1b6075c9071d67a43c797e77693d365ad3fabc9bf756a6d36125244d5497993633135f4524e38a4de67bc45505a4cf4dcb62d68e6a45803ad

  • SSDEEP

    24576:MQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cV/sRyn2U:MQZAdVyVT9n/Gg0P+WhoKoyn2U

Malware Config

Targets

    • Target

      259229f42a47ca11e24682e3ca520ffe2ce5da59c8088cd044645b50cf0c27f0

    • Size

      1.3MB

    • MD5

      fda41840ee0f07f2ffed94a33fa3d1d0

    • SHA1

      52b504d779f56202018177d8fc7881916fef407a

    • SHA256

      259229f42a47ca11e24682e3ca520ffe2ce5da59c8088cd044645b50cf0c27f0

    • SHA512

      c984e3dc819510d1b6075c9071d67a43c797e77693d365ad3fabc9bf756a6d36125244d5497993633135f4524e38a4de67bc45505a4cf4dcb62d68e6a45803ad

    • SSDEEP

      24576:MQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cV/sRyn2U:MQZAdVyVT9n/Gg0P+WhoKoyn2U

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks