Extracted

• • Target

    XiuXiu_aam-X64.msi.vir

  • Size

    30.5MB

  • MD5

    4bb380192889a55fb6c183f8053bedd1

  • SHA1

    1016f0c66c398e28416a457d63f5e066edd7bffb

  • SHA256

    34b150091d625d345d47c908841b2570455388c910e78e1403313fce2e5f2ae3

  • SHA512

    00358460e128f3713a1c0ba7d9581bc7592c7bcb42de1d3201bed67a02884a0e31e7a7a672fa85a105736ddd6f4d6033bed85bc56699c1c96f5a1a018805ccb8

  • SSDEEP

    786432:f+zvk6HbhSjB+x/d5AwL0DibF720rKyNvKbzpkYvRACCFc0yD:Wz869ScxF51L0mF7J+yYzpTZlAc0yD

  Score

  10^/10

  bootkitdiscoveryevasionexecutionpersistenceprivilege_escalationgh0stratpurplefoxratrootkittrojan

  • Detect PurpleFox Rootkit

    Detect PurpleFox Rootkit.

    rootkit

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • Modifies firewall policy service

    evasion

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox

  • Purplefox family

    purplefox

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2