General
- Target 8ab71f177a2861e3959f3ef8aa6ce099c991fe9920fb168926d5d5f5b2aff3bc
- Size 1.2MB
- Sample241106-kynspazkdn
- SHA256 8ab71f177a2861e3959f3ef8aa6ce099c991fe9920fb168926d5d5f5b2aff3bc
Score
10/10
Malware Config
Targets
-
- Target 8ab71f177a2861e3959f3ef8aa6ce099c991fe9920fb168926d5d5f5b2aff3bc
- Size 1.2MB
- SHA256 8ab71f177a2861e3959f3ef8aa6ce099c991fe9920fb168926d5d5f5b2aff3bc
Score10/10Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
Gh0st RAT payload
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
Gh0strat family
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
Purplefox family
Drops file in Drivers directory
Server Software Component: Terminal Services DLL
Sets service image path in registry
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Loads dropped DLL
VMProtect packed file
Detects executables packed with VMProtect commercial packer.
Adds Run key to start application
Drops file in System32 directory
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2