General

  • Target

    70da121cb393f7aa30b3c63e38bf147eb9ae7b5e566d1b46d3ae21f602115eca

  • Size

    2.7MB

  • Sample

    241113-sahkrstkgv

  • MD5

    43c0bd5e0b7f80e51aa47e244c168a19

  • SHA1

    fce0070da62b012adeb97f33e065752f37722184

  • SHA256

    70da121cb393f7aa30b3c63e38bf147eb9ae7b5e566d1b46d3ae21f602115eca

  • SHA512

    2a0b38ef3f6d9667f24d12fd9838d8e607567d4ffa5beae00127c8371802f02604a452622a94a994d9261f9e9042f16fc00e9db564fe094cb5f5849d56b70e4c

  • SSDEEP

    49152:5CwsbCANnKXferL7Vwe/Gg0P+WhUDmn2+:0ws2ANnKXOaeOgmhUDmn2+

Malware Config

Targets

    • Target

      70da121cb393f7aa30b3c63e38bf147eb9ae7b5e566d1b46d3ae21f602115eca

    • Size

      2.7MB

    • MD5

      43c0bd5e0b7f80e51aa47e244c168a19

    • SHA1

      fce0070da62b012adeb97f33e065752f37722184

    • SHA256

      70da121cb393f7aa30b3c63e38bf147eb9ae7b5e566d1b46d3ae21f602115eca

    • SHA512

      2a0b38ef3f6d9667f24d12fd9838d8e607567d4ffa5beae00127c8371802f02604a452622a94a994d9261f9e9042f16fc00e9db564fe094cb5f5849d56b70e4c

    • SSDEEP

      49152:5CwsbCANnKXferL7Vwe/Gg0P+WhUDmn2+:0ws2ANnKXOaeOgmhUDmn2+

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Purplefox family

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks