General

  • Target

    a7fbb8d1e5ae771f51d6c24137d6d8f8b59a4306f8124591c68b69f72c22c2ea.zip

  • Size

    79.4MB

  • Sample

    241111-py3n3aylfx

  • MD5

    93f76162d13675c3d2171237017b01ba

  • SHA1

    3f63b46e6b3f7796d6d8815c139fda69eb1bce2d

  • SHA256

    a7fbb8d1e5ae771f51d6c24137d6d8f8b59a4306f8124591c68b69f72c22c2ea

  • SHA512

    e9b6803917fb3b40f80a48133e5eda12ba71f7bc0ccc7f04392b5db4517eaaf3a2ded8b24911603688272dfdff3a96e9b000cfcc00b43297fc6438aa802ae41c

  • SSDEEP

    1572864:7WMJQDoR10x/FiqYBAibinKq/fOjEjuxC+SuwTUCB7SNgPOT80B6lvhQMF73J:6HY0x/gBAibinuj4bC2ctQ0B6lvCMF75

Malware Config

Targets

    • Target

      2345pic_x64.msi

    • Size

      79.4MB

    • MD5

      fe984489b63aa7cd7aee6c48fe69e08d

    • SHA1

      b5cac8c66311b7601e0ef2a1d134bf06a8079497

    • SHA256

      092ff5eeddfd265d8f37c5a9afbf7c3018ba65fcd0dd59c0237f7e04d1915060

    • SHA512

      806872b46c843727d4a980e46fef0a662115a6429868e74c8889d9363323008797c5b11ad54bb524709cb26087a8bec42b0051f701af4766ee7227068a7a0e92

    • SSDEEP

      1572864:NmsJ8LVVmCjLbWQVZq/5u3dOdYMBWkAhIo/qQXAbJqWOm9uUQerttNG2MZ7dE:ojyCjLLZq/5ukpBVMWchl5erttNXMZ7S

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Purplefox family

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks