Overview

overview

10

Static

static

3

2024-08-31...id.exe

windows7-x64

10

2024-08-31...id.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-08-31_81ad3f1fe8b6db38146123e0cdefec51_hijackloader_icedid

  • Size

    4.6MB

  • Sample

    240831-b2ngnayemn

  • MD5

    81ad3f1fe8b6db38146123e0cdefec51

  • SHA1

    8c41a6d2391bac8364b99a3ffa10abb47b0b5751

  • SHA256

    d6b8e2290447cbc3ff8e7a1f70b72d7ba81920da9154cb0429267c0c5543445c

  • SHA512

    f9a41bfff514919ea85e9479366d01687adf8aa56e825605f297abad385a6b44a2629012787c4bec0cc4ba91ed50dd9a316f85802277e554db8cb4e3fb87fda5

  • SSDEEP

    49152:/89XJt4HIZ/Gg0P+WhONRbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8R:0ZJt4HIZOgmhONRbXsPN5kiQaZ56

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      2024-08-31_81ad3f1fe8b6db38146123e0cdefec51_hijackloader_icedid

    • Size

      4.6MB

    • MD5

      81ad3f1fe8b6db38146123e0cdefec51

    • SHA1

      8c41a6d2391bac8364b99a3ffa10abb47b0b5751

    • SHA256

      d6b8e2290447cbc3ff8e7a1f70b72d7ba81920da9154cb0429267c0c5543445c

    • SHA512

      f9a41bfff514919ea85e9479366d01687adf8aa56e825605f297abad385a6b44a2629012787c4bec0cc4ba91ed50dd9a316f85802277e554db8cb4e3fb87fda5

    • SSDEEP

      49152:/89XJt4HIZ/Gg0P+WhONRbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8R:0ZJt4HIZOgmhONRbXsPN5kiQaZ56

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks