purplefox | d829e97999e1fb03880dc321b0a331937e18b9aa0ee08ca3ab189ce8f410cba1 | Triage

Submit
Reports

Overview

overview

Static

static

1

d829e97999...a1.msi

windows7-x64

d829e97999...a1.msi

windows10-2004-x64

Sharing

General

Target

d829e97999e1fb03880dc321b0a331937e18b9aa0ee08ca3ab189ce8f410cba1.msi.vir
Size

88.1MB
Sample

241130-q1fgzsvqby
MD5

35e04cd304b5cb510dd3e0ad154811bc
SHA1

cee9a92ad938ff9e3074356ced22c30bf3902378
SHA256

d829e97999e1fb03880dc321b0a331937e18b9aa0ee08ca3ab189ce8f410cba1
SHA512

be40162927e06e071dac23c057afbeb7c33c64b433fb1445ba73da5f656f09aa97c2e95798be4b5b19f964803fb7942a34e58222c9823a890f8e890af4538354
SSDEEP

1572864:gMDsZW2KfoM2J0s2nMqZ5Nhy+cWev3mZuHshbCLPyZAoOw8mMvxIQPm0MVp0:FIZW2KQWntH6+cXvjKbCLPyWol8myxh/

Score

10^/10

purplefox discovery persistence privilege_escalation rootkit trojan

Static task

static1

Behavioral task

behavioral1

Sample

d829e97999e1fb03880dc321b0a331937e18b9aa0ee08ca3ab189ce8f410cba1.msi

Resource

win7-20240903-en

purplefox discovery persistence privilege_escalation rootkit trojan

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral2

Sample

d829e97999e1fb03880dc321b0a331937e18b9aa0ee08ca3ab189ce8f410cba1.msi

Resource

win10v2004-20241007-en

purplefox discovery persistence privilege_escalation rootkit trojan

windows10-2004-x64

22 signatures

150 seconds

Malware Config

Targets

- Target
  
  d829e97999e1fb03880dc321b0a331937e18b9aa0ee08ca3ab189ce8f410cba1.msi.vir
- Size
  
  88.1MB
- MD5
  
  35e04cd304b5cb510dd3e0ad154811bc
- SHA1
  
  cee9a92ad938ff9e3074356ced22c30bf3902378
- SHA256
  
  d829e97999e1fb03880dc321b0a331937e18b9aa0ee08ca3ab189ce8f410cba1
- SHA512
  
  be40162927e06e071dac23c057afbeb7c33c64b433fb1445ba73da5f656f09aa97c2e95798be4b5b19f964803fb7942a34e58222c9823a890f8e890af4538354
- SSDEEP
  
  1572864:gMDsZW2KfoM2J0s2nMqZ5Nhy+cWev3mZuHshbCLPyZAoOw8mMvxIQPm0MVp0:FIZW2KQWntH6+cXvjKbCLPyWol8myxh/
Score

10^/10

purplefox discovery persistence privilege_escalation rootkit trojan
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Purplefox family
  purplefox
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Installer Packages

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Installer Packages

Defense Evasion

Modify Registry

System Binary Proxy Execution

Msiexec

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

purplefoxdiscoverypersistenceprivilege_escalationrootkittrojan

behavioral2

purplefoxdiscoverypersistenceprivilege_escalationrootkittrojan

© 2018-2024

Terms | Privacy