Overview

overview

10

Static

static

3

5df4259244...d1.exe

windows7-x64

10

5df4259244...d1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5df42592446c46569dc148016e97edbdcbe6df310815458d8b246ca1cd44cbd1

  • Size

    1.3MB

  • Sample

    241207-nfhqhazrcw

  • MD5

    a493b8400cf4ca4d39752f08e4b0b9d3

  • SHA1

    3e3940021b31a59e99979b59fdb7c612dd309543

  • SHA256

    5df42592446c46569dc148016e97edbdcbe6df310815458d8b246ca1cd44cbd1

  • SHA512

    8fd504d83a5df1eaffb095df5acb01aa9517089a185078b851e3eb79fa9d0e768dfd33c1346e63638b73eec37c2876326bf33cbf88bd0a6f9999bdffb1ad31da

  • SSDEEP

    24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNy:QHPkVOBTK

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojan

Malware Config

Targets

    • Target

      5df42592446c46569dc148016e97edbdcbe6df310815458d8b246ca1cd44cbd1

    • Size

      1.3MB

    • MD5

      a493b8400cf4ca4d39752f08e4b0b9d3

    • SHA1

      3e3940021b31a59e99979b59fdb7c612dd309543

    • SHA256

      5df42592446c46569dc148016e97edbdcbe6df310815458d8b246ca1cd44cbd1

    • SHA512

      8fd504d83a5df1eaffb095df5acb01aa9517089a185078b851e3eb79fa9d0e768dfd33c1346e63638b73eec37c2876326bf33cbf88bd0a6f9999bdffb1ad31da

    • SSDEEP

      24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNy:QHPkVOBTK

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojan

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks