General

  • Target

    0a49bdbae2707f82a0b76b4fd7e8a3e94b42bbd5ad4ab2b4f68c4381ed2eb053

  • Size

    2.8MB

  • Sample

    240626-gq7n2s1hnp

  • MD5

    dc432e2ed9bb48c00f8daac5a68b0095

  • SHA1

    876ad89706a4f26faabb3b29599b094cdbd2b59c

  • SHA256

    0a49bdbae2707f82a0b76b4fd7e8a3e94b42bbd5ad4ab2b4f68c4381ed2eb053

  • SHA512

    03e32f0cf053776f2e9773fb3870a0f638ddd101ecd959ceae479e4bc1d98bf114b6bbb0caa516fed1014cc7909badf6cc465bc958ce4d4823076fcce276480d

  • SSDEEP

    49152:/CwsbCANnKXferL7Vwe/Gg0P+WhZye3JDmn2i:qws2ANnKXOaeOgmhZn3JDmn2i

Malware Config

Targets

    • Target

      0a49bdbae2707f82a0b76b4fd7e8a3e94b42bbd5ad4ab2b4f68c4381ed2eb053

    • Size

      2.8MB

    • MD5

      dc432e2ed9bb48c00f8daac5a68b0095

    • SHA1

      876ad89706a4f26faabb3b29599b094cdbd2b59c

    • SHA256

      0a49bdbae2707f82a0b76b4fd7e8a3e94b42bbd5ad4ab2b4f68c4381ed2eb053

    • SHA512

      03e32f0cf053776f2e9773fb3870a0f638ddd101ecd959ceae479e4bc1d98bf114b6bbb0caa516fed1014cc7909badf6cc465bc958ce4d4823076fcce276480d

    • SSDEEP

      49152:/CwsbCANnKXferL7Vwe/Gg0P+WhZye3JDmn2i:qws2ANnKXOaeOgmhZn3JDmn2i

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks