Overview

overview

10

Static

static

3

91124cf3f9...be.exe

windows7-x64

10

91124cf3f9...be.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    91124cf3f9aa8c849baab0f276e86bd97307aea298cf5078105d882b897c70be

  • Size

    1.2MB

  • Sample

    241115-qerywstmfw

  • MD5

    bbf3adc38d1fb55d4e6139f963cd5efb

  • SHA1

    e5fa56972a9e04e86ee7789cfcc08dbe29b57da5

  • SHA256

    91124cf3f9aa8c849baab0f276e86bd97307aea298cf5078105d882b897c70be

  • SHA512

    7a17d266e080a9ba5853be68dbde2e07338ff463108d4d01f5e83cba0e94a4a6969e8ac385d6af14dae7622268a2d24fca1ff257bd45047aefdc06c377d8ba94

  • SSDEEP

    24576:MQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVkwpe5j:MQZAdVyVT9n/Gg0P+Whoepep

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      91124cf3f9aa8c849baab0f276e86bd97307aea298cf5078105d882b897c70be

    • Size

      1.2MB

    • MD5

      bbf3adc38d1fb55d4e6139f963cd5efb

    • SHA1

      e5fa56972a9e04e86ee7789cfcc08dbe29b57da5

    • SHA256

      91124cf3f9aa8c849baab0f276e86bd97307aea298cf5078105d882b897c70be

    • SHA512

      7a17d266e080a9ba5853be68dbde2e07338ff463108d4d01f5e83cba0e94a4a6969e8ac385d6af14dae7622268a2d24fca1ff257bd45047aefdc06c377d8ba94

    • SSDEEP

      24576:MQZoidOTdVZinacCET9Ecl1erdg0MCiVWhFU7cVkwpe5j:MQZAdVyVT9n/Gg0P+Whoepep

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

      persistence

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks