General
-
Target
a7fbb8d1e5ae771f51d6c24137d6d8f8b59a4306f8124591c68b69f72c22c2ea.zip
-
Size
79.4MB
-
Sample
241111-py3n3aylfx
-
MD5
93f76162d13675c3d2171237017b01ba
-
SHA1
3f63b46e6b3f7796d6d8815c139fda69eb1bce2d
-
SHA256
a7fbb8d1e5ae771f51d6c24137d6d8f8b59a4306f8124591c68b69f72c22c2ea
-
SHA512
e9b6803917fb3b40f80a48133e5eda12ba71f7bc0ccc7f04392b5db4517eaaf3a2ded8b24911603688272dfdff3a96e9b000cfcc00b43297fc6438aa802ae41c
-
SSDEEP
1572864:7WMJQDoR10x/FiqYBAibinKq/fOjEjuxC+SuwTUCB7SNgPOT80B6lvhQMF73J:6HY0x/gBAibinuj4bC2ctQ0B6lvCMF75
Malware Config
Targets
-
-
Target
2345pic_x64.msi
-
Size
79.4MB
-
MD5
fe984489b63aa7cd7aee6c48fe69e08d
-
SHA1
b5cac8c66311b7601e0ef2a1d134bf06a8079497
-
SHA256
092ff5eeddfd265d8f37c5a9afbf7c3018ba65fcd0dd59c0237f7e04d1915060
-
SHA512
806872b46c843727d4a980e46fef0a662115a6429868e74c8889d9363323008797c5b11ad54bb524709cb26087a8bec42b0051f701af4766ee7227068a7a0e92
-
SSDEEP
1572864:NmsJ8LVVmCjLbWQVZq/5u3dOdYMBWkAhIo/qQXAbJqWOm9uUQerttNG2MZ7dE:ojyCjLLZq/5ukpBVMWchl5erttNXMZ7S
Score10/10-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Purplefox family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-