purplefox | 1f8bd3be8998046f4d49d6a7a2f8e13980de241fdb0c4c8b3c2de467fb425461 | Triage

Submit
Reports

Overview

overview

Static

static

1

1f8bd3be89...61.msi

windows7-x64

1f8bd3be89...61.msi

windows10-2004-x64

Sharing

General

Target

1f8bd3be8998046f4d49d6a7a2f8e13980de241fdb0c4c8b3c2de467fb425461.msi.vir
Size

88.1MB
Sample

241128-hbx2qsynaz
MD5

9b6d3f468e121e147da06c5fa36c48a4
SHA1

72f49dd62358b63bcec6b7f8d6ddb297890ae9de
SHA256

1f8bd3be8998046f4d49d6a7a2f8e13980de241fdb0c4c8b3c2de467fb425461
SHA512

4faa2ecab2359a7eda3124fdebb0b567ff236333cb7d7f98dd0bd23077249ca17aea01eed0827b89740e7f8764e9eb02b99001ac2d498c8072ebc14a130eb81a
SSDEEP

1572864:NB9nyr53s/zJIWTcBlboCqFM1YZO4gOwexegi0vq3ZCUiLe2GK8uq8iZFnH:Nnnyr5c5cPM1M1GOcAgi0vqpCZLeVKUb

Score

10^/10

purplefox discovery persistence privilege_escalation rootkit trojan

Static task

static1

Behavioral task

behavioral1

Sample

1f8bd3be8998046f4d49d6a7a2f8e13980de241fdb0c4c8b3c2de467fb425461.msi

Resource

win7-20240903-en

purplefox discovery persistence privilege_escalation rootkit trojan

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral2

Sample

1f8bd3be8998046f4d49d6a7a2f8e13980de241fdb0c4c8b3c2de467fb425461.msi

Resource

win10v2004-20241007-en

purplefox discovery persistence privilege_escalation rootkit trojan

windows10-2004-x64

22 signatures

150 seconds

Malware Config

Targets

- Target
  
  1f8bd3be8998046f4d49d6a7a2f8e13980de241fdb0c4c8b3c2de467fb425461.msi.vir
- Size
  
  88.1MB
- MD5
  
  9b6d3f468e121e147da06c5fa36c48a4
- SHA1
  
  72f49dd62358b63bcec6b7f8d6ddb297890ae9de
- SHA256
  
  1f8bd3be8998046f4d49d6a7a2f8e13980de241fdb0c4c8b3c2de467fb425461
- SHA512
  
  4faa2ecab2359a7eda3124fdebb0b567ff236333cb7d7f98dd0bd23077249ca17aea01eed0827b89740e7f8764e9eb02b99001ac2d498c8072ebc14a130eb81a
- SSDEEP
  
  1572864:NB9nyr53s/zJIWTcBlboCqFM1YZO4gOwexegi0vq3ZCUiLe2GK8uq8iZFnH:Nnnyr5c5cPM1M1GOcAgi0vqpCZLeVKUb
Score

10^/10

purplefox discovery persistence privilege_escalation rootkit trojan
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Purplefox family
  purplefox
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Installer Packages

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Installer Packages

Defense Evasion

Modify Registry

System Binary Proxy Execution

Msiexec

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

purplefoxdiscoverypersistenceprivilege_escalationrootkittrojan

behavioral2

purplefoxdiscoverypersistenceprivilege_escalationrootkittrojan

© 2018-2025

Terms | Privacy