Overview

overview

10

Static

static

3

cba6d61c36...5b.exe

windows7-x64

10

cba6d61c36...5b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cba6d61c366abf0fe6796b5ea30997a678f17da820dcd4b2ffc8b0c126b44a5b

  • Size

    1.2MB

  • Sample

    240823-bzgw4aydmg

  • MD5

    1a8cf4ca719ff4fa73d160d36a4a2b38

  • SHA1

    96e5abc09a440451ac070acc71e950d73c3be78d

  • SHA256

    cba6d61c366abf0fe6796b5ea30997a678f17da820dcd4b2ffc8b0c126b44a5b

  • SHA512

    a34f84d2c4771df3d2ec95859435e9d33860012a7e50905259a00256105dd08a81f09a93f05f0b15916fd9aebcd49f764491b1bbf9410f82a287072063c568bd

  • SSDEEP

    24576:JQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVKR70JeS:JQZAdVyVT9n/Gg0P+WhoB5WeS

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      cba6d61c366abf0fe6796b5ea30997a678f17da820dcd4b2ffc8b0c126b44a5b

    • Size

      1.2MB

    • MD5

      1a8cf4ca719ff4fa73d160d36a4a2b38

    • SHA1

      96e5abc09a440451ac070acc71e950d73c3be78d

    • SHA256

      cba6d61c366abf0fe6796b5ea30997a678f17da820dcd4b2ffc8b0c126b44a5b

    • SHA512

      a34f84d2c4771df3d2ec95859435e9d33860012a7e50905259a00256105dd08a81f09a93f05f0b15916fd9aebcd49f764491b1bbf9410f82a287072063c568bd

    • SSDEEP

      24576:JQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVKR70JeS:JQZAdVyVT9n/Gg0P+WhoB5WeS

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks