Overview

overview

10

Static

static

3

592f02b55e...17.exe

windows7-x64

10

592f02b55e...17.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    592f02b55edd3f9ad577fc8e1b67234122cef056bddd22fe53fc84d766815717

  • Size

    2.3MB

  • Sample

    241203-z1e1wsvja1

  • MD5

    6bab21dcba677a1a03b457d101068676

  • SHA1

    5437bda1772c2b31f03c68f47d4c48c40b9c9edf

  • SHA256

    592f02b55edd3f9ad577fc8e1b67234122cef056bddd22fe53fc84d766815717

  • SHA512

    2a3cba4d6cefbbbeea142185eb431e3caf6b6d23680147497b1e3ab339323f2d6c6606b0032f5c8b08de156f4c5664f166b4c8f2cf6b4425003e1f43c5ce952e

  • SSDEEP

    49152:kHPkVOBTKdSZRKdkaaeAN+LYc//////////////////////////////////////X:5O0dGgCaaeTT////////////////////

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojan

Malware Config

Targets

    • Target

      592f02b55edd3f9ad577fc8e1b67234122cef056bddd22fe53fc84d766815717

    • Size

      2.3MB

    • MD5

      6bab21dcba677a1a03b457d101068676

    • SHA1

      5437bda1772c2b31f03c68f47d4c48c40b9c9edf

    • SHA256

      592f02b55edd3f9ad577fc8e1b67234122cef056bddd22fe53fc84d766815717

    • SHA512

      2a3cba4d6cefbbbeea142185eb431e3caf6b6d23680147497b1e3ab339323f2d6c6606b0032f5c8b08de156f4c5664f166b4c8f2cf6b4425003e1f43c5ce952e

    • SSDEEP

      49152:kHPkVOBTKdSZRKdkaaeAN+LYc//////////////////////////////////////X:5O0dGgCaaeTT////////////////////

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojan

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks