Extracted

• • Target

    361672610e68bd986413f7cbc8eea348092fc5159d8ff734fd9e644d9be10fe0

  • Size

    611KB

  • MD5

    40f8c9c8486eccb0342c69b0d05294b9

  • SHA1

    d9b4fea9244170e4038fbdee74cfbf83746a76c3

  • SHA256

    361672610e68bd986413f7cbc8eea348092fc5159d8ff734fd9e644d9be10fe0

  • SHA512

    207dcec07c40e756e17cde77e6e51d04a458d679df012f883e62a35a144a652cf0e62ee3205664a8b270114203537e3539cbbf081c9e1e9daad1de97ca4d2cfe

  • SSDEEP

    12288:aFpuzZSkcBNrl5mTEUkDaSdJfpSaoNRVBUyMCe8VMM80B7qrI3iK1XBwZQ:aFmShDrngEUkDaiJfpSaoNRpMCe8CM8T

  Score

  10^/10

  gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

  • Detect PurpleFox Rootkit

    Detect PurpleFox Rootkit.

    rootkit

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox

  • Drops file in Drivers directory

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2