Overview

overview

10

Static

static

3

5f35f33925...06.exe

windows7-x64

10

5f35f33925...06.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f35f3392507407bf2c56783ae3a0230536b37779fae954beae8a220f77c8906

  • Size

    1.7MB

  • Sample

    240826-s9zckatbnk

  • MD5

    0d3fec8c0d605b2edb8e31ab316d6f86

  • SHA1

    e484fa7f5fda691ee3b621e42bfcc292decd885f

  • SHA256

    5f35f3392507407bf2c56783ae3a0230536b37779fae954beae8a220f77c8906

  • SHA512

    8af966f9a1d002c2338a52249d5c74f4a2b3c486a99ba099f17a25add3d6ea88f3507acbc4c55306699ca612af15754f6415310f32407bb8b51d9ccb5dc1c111

  • SSDEEP

    49152:CH3BEj/dUf/1DkjJ/MB7sE2VG9yF8ehCsrVp:+3B2/CwMBwEzlenz

Score
10/10
gh0stratpurplefoxdiscoveryratrootkittrojan

Malware Config

Targets

    • Target

      5f35f3392507407bf2c56783ae3a0230536b37779fae954beae8a220f77c8906

    • Size

      1.7MB

    • MD5

      0d3fec8c0d605b2edb8e31ab316d6f86

    • SHA1

      e484fa7f5fda691ee3b621e42bfcc292decd885f

    • SHA256

      5f35f3392507407bf2c56783ae3a0230536b37779fae954beae8a220f77c8906

    • SHA512

      8af966f9a1d002c2338a52249d5c74f4a2b3c486a99ba099f17a25add3d6ea88f3507acbc4c55306699ca612af15754f6415310f32407bb8b51d9ccb5dc1c111

    • SSDEEP

      49152:CH3BEj/dUf/1DkjJ/MB7sE2VG9yF8ehCsrVp:+3B2/CwMBwEzlenz

    Score
    10/10
    gh0stratpurplefoxdiscoveryratrootkittrojan

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks