Overview

overview

10

Static

static

3

c05361b9ad...18.exe

windows7-x64

10

c05361b9ad...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c05361b9adb7aab5598de6a0b96e2826_JaffaCakes118

  • Size

    1.7MB

  • Sample

    241204-ck1lbswmd1

  • MD5

    c05361b9adb7aab5598de6a0b96e2826

  • SHA1

    c5f9c3bf4c8b287a0cfa429d8365fb39345fb2bd

  • SHA256

    9070061c6f0ca4fe0170ae5b64ec0ef4342bd2f83821d9e07e43eb3cc6a3e4b8

  • SHA512

    50bc04db9d5679792f65124826084b6541fed2e6933de380edf66a2df87a8209957eba6b5c35a6beba215446c64837b22142654978e858e8deb2e4838687c39c

  • SSDEEP

    24576:D09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+b4+p6:D09XJt4HIN2H2tFvduySO+Y

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      c05361b9adb7aab5598de6a0b96e2826_JaffaCakes118

    • Size

      1.7MB

    • MD5

      c05361b9adb7aab5598de6a0b96e2826

    • SHA1

      c5f9c3bf4c8b287a0cfa429d8365fb39345fb2bd

    • SHA256

      9070061c6f0ca4fe0170ae5b64ec0ef4342bd2f83821d9e07e43eb3cc6a3e4b8

    • SHA512

      50bc04db9d5679792f65124826084b6541fed2e6933de380edf66a2df87a8209957eba6b5c35a6beba215446c64837b22142654978e858e8deb2e4838687c39c

    • SSDEEP

      24576:D09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+b4+p6:D09XJt4HIN2H2tFvduySO+Y

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks