Extracted

• • Target

    1c50bafd6def9ad28bc614e32f7c9581322625240c18d487ab900208013c3144

  • Size

    15.4MB

  • MD5

    a5cd1a54ebdd40b3376e457c43c9e543

  • SHA1

    387fefefd8c2edb54975d82cc41179bbbb51b1c8

  • SHA256

    1c50bafd6def9ad28bc614e32f7c9581322625240c18d487ab900208013c3144

  • SHA512

    18f35ddd8bc30b22f33e1bddc0c91184dfa45da5a456cd1035d031415298a67eafbb70aab16ec01b4e8cb10bcb081242bc9c9746b1eadb868117bbdd6fc7415c

  • SSDEEP

    196608:kKXbeO73bL3rUP1Luepkfw5jmBbyKMdCSTkGE7nWoRPep3q:V7LXyieJ5KBGJCBGNoBes

  Score

  10^/10

  gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

  • Detect PurpleFox Rootkit

    Detect PurpleFox Rootkit.

    rootkit

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox

  • Drops file in Drivers directory

  • Server Software Component: Terminal Services DLL

    persistence

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2