Overview

overview

10

Static

static

1

8c310eb0db...ba.msi

windows7-x64

10

8c310eb0db...ba.msi

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8c310eb0dbd0535f80823b9872be064319557be6d0e2af87354b36e3bd18c1ba.msi.v

  • Size

    135.8MB

  • Sample

    241025-gvdxjavhla

  • MD5

    7d7b21481f592845a5c06b69f4c61154

  • SHA1

    f71b985fd0db5a228cafecfcce661cf552042dc7

  • SHA256

    8c310eb0dbd0535f80823b9872be064319557be6d0e2af87354b36e3bd18c1ba

  • SHA512

    719cb203e1d1c87f5dbacee0266e183a51519a4acd60fe78b8f7198b19bf42dab5126009696fc21101647f4fcc2207e472f8169a01d443a22e492abfa5d7b77e

  • SSDEEP

    3145728:deYKj8WH3zFrbOc+ZWh4kWjoNFoaApVQ9CBkNNWv3Lp9p9:tCjhbOJWhi4FoMy0NWv7p

Score
10/10
gh0stratpurplefoxdiscoverypersistenceprivilege_escalationratrootkittrojan

Malware Config

Targets

    • Target

      8c310eb0dbd0535f80823b9872be064319557be6d0e2af87354b36e3bd18c1ba.msi.v

    • Size

      135.8MB

    • MD5

      7d7b21481f592845a5c06b69f4c61154

    • SHA1

      f71b985fd0db5a228cafecfcce661cf552042dc7

    • SHA256

      8c310eb0dbd0535f80823b9872be064319557be6d0e2af87354b36e3bd18c1ba

    • SHA512

      719cb203e1d1c87f5dbacee0266e183a51519a4acd60fe78b8f7198b19bf42dab5126009696fc21101647f4fcc2207e472f8169a01d443a22e492abfa5d7b77e

    • SSDEEP

      3145728:deYKj8WH3zFrbOc+ZWh4kWjoNFoaApVQ9CBkNNWv3Lp9p9:tCjhbOJWhi4FoMy0NWv7p

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceprivilege_escalationratrootkittrojan

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks