General

  • Target

    1fbeea90a5cd6e64080fb9ae546f79d837d713c28d3ba2da90bc082bbe2a2c48

  • Size

    1.2MB

  • Sample

    241110-byqslswfrr

  • MD5

    ec9be743c200e284ee8f6a864416dd27

  • SHA1

    b895c6d1996bb07b6991ceb41d5f7b41f12d49e6

  • SHA256

    1fbeea90a5cd6e64080fb9ae546f79d837d713c28d3ba2da90bc082bbe2a2c48

  • SHA512

    503fc9b3016e6eeea24ce2b9d9b5e600bced82647e0e5e11844c55c6f6b98560f4c6db804ab7af3a13369d1e68e08153967d9e82db33632e8706cdb03994b042

  • SSDEEP

    24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiG:WIwgMEuy+inDfp3/XoCw57XYBwKG

Malware Config

Targets

    • Target

      1fbeea90a5cd6e64080fb9ae546f79d837d713c28d3ba2da90bc082bbe2a2c48

    • Size

      1.2MB

    • MD5

      ec9be743c200e284ee8f6a864416dd27

    • SHA1

      b895c6d1996bb07b6991ceb41d5f7b41f12d49e6

    • SHA256

      1fbeea90a5cd6e64080fb9ae546f79d837d713c28d3ba2da90bc082bbe2a2c48

    • SHA512

      503fc9b3016e6eeea24ce2b9d9b5e600bced82647e0e5e11844c55c6f6b98560f4c6db804ab7af3a13369d1e68e08153967d9e82db33632e8706cdb03994b042

    • SSDEEP

      24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiG:WIwgMEuy+inDfp3/XoCw57XYBwKG

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Purplefox family

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Adds Run key to start application

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks