Overview

overview

10

Static

static

3

a61f9a5f40...df.exe

windows7-x64

10

a61f9a5f40...df.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a61f9a5f4013c7ee7db50940bf61b9361bb395a27e832238db206406264d79df

  • Size

    732KB

  • Sample

    241011-m9xabatgrp

  • MD5

    3bf88b36764e81cc187440ee7730204f

  • SHA1

    988e7d59ba4fa218dc048a197d4c2342c76abca2

  • SHA256

    a61f9a5f4013c7ee7db50940bf61b9361bb395a27e832238db206406264d79df

  • SHA512

    2d721d4bde2e59e8ea6fc84ef3b79ec78483b282cba9a20920dca6585bb82cb6344b1304271f44dff101d6f6ce3c65e58b8fdd0b06b1b2eba289bdb44d4d7b47

  • SSDEEP

    12288:6i2cAro2HQVWAHkFSq2hAWJYlMUtrxlyuJVRe8yoPdzj6W:6i2Tro2H2HESq2eWJ6MQjySjyoPdzj6W

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      a61f9a5f4013c7ee7db50940bf61b9361bb395a27e832238db206406264d79df

    • Size

      732KB

    • MD5

      3bf88b36764e81cc187440ee7730204f

    • SHA1

      988e7d59ba4fa218dc048a197d4c2342c76abca2

    • SHA256

      a61f9a5f4013c7ee7db50940bf61b9361bb395a27e832238db206406264d79df

    • SHA512

      2d721d4bde2e59e8ea6fc84ef3b79ec78483b282cba9a20920dca6585bb82cb6344b1304271f44dff101d6f6ce3c65e58b8fdd0b06b1b2eba289bdb44d4d7b47

    • SSDEEP

      12288:6i2cAro2HQVWAHkFSq2hAWJYlMUtrxlyuJVRe8yoPdzj6W:6i2Tro2H2HESq2eWJ6MQjySjyoPdzj6W

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks