General
-
Target
yuanchangkuirr-intrallar.zip
-
Size
72.2MB
-
Sample
241023-cmt7bswepa
-
MD5
64d1229411000e52a09f91fc43e12525
-
SHA1
ca5d7b20391545e1db054230dd0a768c954c0e2b
-
SHA256
2bd63252d1eeec4888e0674d52d5dfa80bd69d8accd64f7fb1ea6bdcbe9d4a61
-
SHA512
8b9aaeff856bab09913c59231267df2e2e17658d0a8493f2ca5485ac2e4f3b814c2755f5f57447bfc717aac11fe1dbe02dbc1504c8ae03498be9fb134b18693d
-
SSDEEP
1572864:wvoP5zeUbppi840PhTqHgWXLhm5d1s+iGU/69IcJYpJg1GezL:jZbppD4iJqAAm5d1Vi6PV1Gen
Malware Config
Targets
-
-
Target
yuanchangkuirr-intrallar.msi
-
Size
72.3MB
-
MD5
31e8ef3c0591e3ce82cb1c43fb6459c2
-
SHA1
2adc3a5470d7e7507c60e6bf88d86985b2d3a7b9
-
SHA256
9e0543dbde32aeacb27324fc070be63ae7bf679fbe69a4836e3dab627812a7b8
-
SHA512
c1607b5a051fe034378dee8c27aca1effbdf4ab985a500160f2260403bace6f5575117e73a21878ec3f88d1bde49f56cc99184012cb66d1cb2bdc2a7defb4994
-
SSDEEP
1572864:DNDFH5QOjDdexAgZt/qNOU1bpJh11+exX8t6iwwdM1ZE0d+LH:1xjDdKAqFqQCJh11/xYP50d+7
Score10/10-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-