General
-
Target
Chromestup.zip
-
Size
2.6MB
-
Sample
241028-knr3csvgpp
-
MD5
aa3e61c91ad38e017c5e978e96e2ae7c
-
SHA1
a9d53993cd2794306796db7e92e3ce81facbc627
-
SHA256
d8848c1a3b8c464f20a99142a7e319ac9c580768e888a52404c17cefae497606
-
SHA512
a72d3c3610e86de7f6979839f283c00f31563c3c6e6ff4f7f80766bec2fa0a15bd6058cea12ab7e88f99fc3c0abbbbee3992e775e352a8bd4485c21699fb9832
-
SSDEEP
49152:1Z5EnIhBtwv+sWrqNMXsG0sUZ5N3Yw6Rok9ODOi/KwuZV1iZyfPlcEX:1ZCmwWjcjAidYw6pOaAu/1ikf9X
Malware Config
Targets
-
-
Target
Chromestup翻译插件.msi
-
Size
2.6MB
-
MD5
75a1688aca4c2641659f060d86f6b612
-
SHA1
a1740d536b654d4a381c9089ce51dd2026efa819
-
SHA256
e7dcdf225c0edd20c920d918b05dab323ce787aae54768cd15ad406ac26e2ae9
-
SHA512
ce7169ac22f21c1010ea60eef8be106beae453929907d3beee8fd245fe7ec51e635846c6f8af4d80d2cd8a533bf994ae2490a3ed9b48467a009798b849baa80c
-
SSDEEP
49152:0FvHELEfBtQTIoWd4rUXs6kA+h5N3IaaLoWNAxOiZowguCIFVx0K5xU:0FveQQE5SBGkpIaavAQag67x0K5xU
Score10/10-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Purplefox family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-