purplefox | 383e501270d7dee3cf9612e19ae12460efeb95c6144d1c376358ae04e2956386

Sharing

Copy URL

Twitter E-mail

General

Target

383e501270d7dee3cf9612e19ae12460efeb95c6144d1c376358ae04e2956386
Size

2.8MB
MD5

2c15f54532b3fa104eb490c2e9aa4e72
SHA1

50a1f275ee91660bfec732df09c08af39e7f569c
SHA256

383e501270d7dee3cf9612e19ae12460efeb95c6144d1c376358ae04e2956386
SHA512

ddf26b939770b67f8d4834cb501b2f13de44dc07000191f4d86a34eac672d4d3b50d5e48c44aa0babd3c74d5acf9568aedb454e9c36dad5cdffd17f2a08bd89d
SSDEEP

24576:F0OzSBxBwtCcHXiFffGgtTzdNbExFM53eHviU4MtRO0ys9WCtK0jX/:F5EQHmfGybEx3jX/

Score

10^/10

rootkit purplefox

Malware Config

Signatures

Detect PurpleFox Rootkit 1 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
sample	purplefox_rootkit

Purplefox family
purplefox

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
383e501270d7dee3cf9612e19ae12460efeb95c6144d1c376358ae04e2956386

Files

383e501270d7dee3cf9612e19ae12460efeb95c6144d1c376358ae04e2956386
.exe windows:4 windows x86 arch:x86

fc2fa1bde7fcc11236646b8f17d6b56c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32First
ExitProcess
GetVersion
DeviceIoControl
Beep
TerminateThread
GetTickCount
GetModuleFileNameA
GetCommandLineA
FreeConsole
TerminateProcess
OpenProcess
GetCurrentProcessId
GetConsoleProcessList
AttachConsole
GetWindowsDirectoryA
WideCharToMultiByte
MultiByteToWideChar
GlobalSize
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryW
GlobalMemoryStatusEx
GetSystemInfo
GetVersionExA
GetSystemDirectoryW
GetModuleFileNameW
CreateMutexA
GetCurrentThread
GetEnvironmentVariableA
GetCurrentThreadId
OutputDebugStringA
IsDebuggerPresent
SetUnhandledExceptionFilter
lstrcpyW
WinExec
Module32Next
lstrcmpiA
Module32First
CreateRemoteThread
GetProcessId
GetPriorityClass
GlobalMemoryStatus
GetComputerNameA
GetPrivateProfileStringA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
lstrcpynA
lstrcmpA
Process32Next
GetFullPathNameW
CreateFileW
GetModuleHandleW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
FlushFileBuffers
SetStdHandle
GetOEMCP
GetACP
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
GetStringTypeW
GetStringTypeA
IsBadCodePtr
SetConsoleCtrlHandler
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
HeapCreate
HeapDestroy
FatalAppExitA
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetStdHandle
DebugBreak
GetStartupInfoA
RaiseException
InterlockedIncrement
InterlockedDecrement
HeapValidate
IsBadWritePtr
RtlUnwind
CreateToolhelp32Snapshot
MoveFileA
SetFileAttributesA
RemoveDirectoryA
FindFirstFileA
FindNextFileA
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
lstrcatA
CreateProcessA
lstrcpyA
CreateDirectoryA
GetLastError
DeleteFileA
GetCurrentProcess
IsWow64Process
SetFilePointer
GetProcAddress
WriteFile
LocalSize
GetSystemDirectoryA
GetFileAttributesA
CreateFileA
GetFileSize
ReadFile
lstrlenA
LocalReAlloc
Sleep
LocalAlloc
LocalFree
FreeLibrary
IsBadReadPtr
VirtualProtect
HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree
CancelIo
SetEvent
ResetEvent
CreateEventA
GetModuleHandleA
GetLocalTime
GlobalAlloc
GlobalLock
GlobalFree
GlobalUnlock
CreateThread
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
InterlockedExchange
WaitForSingleObject
CloseHandle
LoadLibraryA
SetEndOfFile

user32

GetAsyncKeyState
GetKeyState
DefWindowProcA
SendMessageA
DispatchMessageA
TranslateMessage
IsDialogMessageA
CreateWindowExA
RegisterClassExA
GetMessageA
SetWindowPos
GetDlgItem
CreateDialogIndirectParamA
PostQuitMessage
DestroyWindow
SetDlgItemTextA
WaitForInputIdle
GetWindowTextLengthA
SetFocus
GetDlgItemTextA
SetClassLongA
LoadIconA
SetWindowLongA
GetWindowLongA
ShowWindow
wsprintfA
CharNextA
MessageBoxA
EnumWindows
ExitWindowsEx
SwapMouseButton
MoveWindow
GetWindowRect
GetForegroundWindow
FindWindowA
GetDC
LoadCursorA
DestroyCursor
BlockInput
ReleaseDC
SetWindowTextA
GetWindowThreadProcessId
IsWindowVisible
GetClassNameA
GetWindow
PostMessageA
SetThreadDesktop
GetUserObjectInformationA
GetThreadDesktop
CloseDesktop
OpenInputDesktop
SystemParametersInfoA
keybd_event
MapVirtualKeyA
mouse_event
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
GetCursorPos
GetCursorInfo
GetWindowTextA

gdi32

SelectObject
CreateDIBSection
DeleteObject
DeleteDC
BitBlt
GetRegionData
CombineRgn
CreateRectRgnIndirect
GetDIBits
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC

advapi32

RegSaveKeyA
RegRestoreKeyA
RegCreateKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
FreeSid
DeleteService
SetServiceStatus
OpenSCManagerA
OpenServiceA
CloseServiceHandle
StartServiceA
RegCreateKeyA
RegSetValueExA
OpenEventLogA
ClearEventLogA
CloseEventLog
GetUserNameA
RegOpenKeyExA
RegQueryValueA
RegCloseKey
GetTokenInformation
LookupAccountSidA
AbortSystemShutdownA
RegOpenKeyA
RegFlushKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
EnumServicesStatusA
QueryServiceConfigA
QueryServiceConfig2A
QueryServiceStatus
UnlockServiceDatabase
ChangeServiceConfigA
LockServiceDatabase
ControlService

shell32

SHGetSpecialFolderPathA
SHGetFileInfoA
ShellExecuteExA
SHGetFolderPathA

ole32

CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

SysFreeString

winmm

mciSendStringA
waveInGetNumDevs

ws2_32

WSAStartup
recv
select
WSAIoctl
setsockopt
connect
htons
gethostbyname
ioctlsocket
__WSAFDIsSet
recvfrom
sendto
listen
accept
getpeername
bind
getsockname
inet_addr
gethostname
ntohs
inet_ntoa
WSACleanup
send
closesocket
socket

iphlpapi

GetIfTable

shlwapi

SHDeleteKeyA

netapi32

NetUserDel
NetUserAdd
NetLocalGroupAddMembers
NetUserEnum
NetUserGetInfo
NetApiBufferFree
NetUserGetLocalGroups
NetUserSetInfo

psapi

GetProcessMemoryInfo
GetModuleFileNameExA

wininet

HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
DeleteUrlCacheEntry
InternetReadFile

wtsapi32

WTSDisconnectSession
WTSQuerySessionInformationW
WTSEnumerateSessionsA
WTSFreeMemory
WTSQuerySessionInformationA
WTSLogoffSession

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rotext
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 324KB - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 248KB - Virtual size: 749KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc2fa1bde7fcc11236646b8f17d6b56c

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

winmm

ws2_32

iphlpapi

shlwapi

netapi32

psapi

wininet

wtsapi32

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rodata Size: 20KB - Virtual size: 18KB

.rotext Size: 140KB - Virtual size: 138KB

.rdata Size: 324KB - Virtual size: 321KB

.data Size: 248KB - Virtual size: 749KB

.idata Size: 12KB - Virtual size: 11KB

.rsrc Size: 16KB - Virtual size: 15KB

.reloc Size: 44KB - Virtual size: 42KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rodata
Size: 20KB - Virtual size: 18KB

.rotext
Size: 140KB - Virtual size: 138KB

.rdata
Size: 324KB - Virtual size: 321KB

.data
Size: 248KB - Virtual size: 749KB

.idata
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 44KB - Virtual size: 42KB