General
-
Target
sougou_setup.msi.vir
-
Size
157.6MB
-
Sample
241118-fls5esymes
-
MD5
5f3ca4cafda845296871c4e81fba5816
-
SHA1
a0d2af0c912dc0205a1fcd853444f2fa1f643968
-
SHA256
4315a6afe728ff28580a4c7ef798c47ccd7a438bbf58e97aaffce26b837c7384
-
SHA512
e103c3abf292ca634a5713e1abe913b3d8c25cb95321dcbb80e8737b593edb46f56b4b62620a03f0d5e00d73d7f7e793fec983cd20430d9c69b38015667de625
-
SSDEEP
3145728:SM/Vo6HfuRAXjkxF9zS21RHzmbIadvPVkq8HlZ3R78/x865/PxzHMfSVCv4w:doeIATsFo0RHYFdvNkXlZ3R7gx861pz6
Malware Config
Targets
-
-
Target
sougou_setup.msi.vir
-
Size
157.6MB
-
MD5
5f3ca4cafda845296871c4e81fba5816
-
SHA1
a0d2af0c912dc0205a1fcd853444f2fa1f643968
-
SHA256
4315a6afe728ff28580a4c7ef798c47ccd7a438bbf58e97aaffce26b837c7384
-
SHA512
e103c3abf292ca634a5713e1abe913b3d8c25cb95321dcbb80e8737b593edb46f56b4b62620a03f0d5e00d73d7f7e793fec983cd20430d9c69b38015667de625
-
SSDEEP
3145728:SM/Vo6HfuRAXjkxF9zS21RHzmbIadvPVkq8HlZ3R78/x865/PxzHMfSVCv4w:doeIATsFo0RHYFdvNkXlZ3R7gx861pz6
Score10/10-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Purplefox family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-