Overview

overview

10

Static

static

3

39644b49b9...fa.exe

windows7-x64

10

39644b49b9...fa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    39644b49b99c9bc377b468c223000fd5446a71b679b285d2a88ea7d7ecea02fa

  • Size

    1.4MB

  • Sample

    241212-tmpehs1pbr

  • MD5

    5b22d7770f0a13b132abe8225d3d0840

  • SHA1

    95054ea7916a1c004972c8d6c657b6da31143104

  • SHA256

    39644b49b99c9bc377b468c223000fd5446a71b679b285d2a88ea7d7ecea02fa

  • SHA512

    46dd14c8cec28a2ff6ab968705c2b3bac2cb5a99249d7380c6c3b8afba7a10163916276546ed9420f9f189cf6ffd8f2b953f9a0255294f778e5e0e0a83164117

  • SSDEEP

    24576:n39WkOyHutimZ9VSly2hVvHW6qMnSbTBBhBMN:39qHPkVOBTK

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojan

Malware Config

Targets

    • Target

      39644b49b99c9bc377b468c223000fd5446a71b679b285d2a88ea7d7ecea02fa

    • Size

      1.4MB

    • MD5

      5b22d7770f0a13b132abe8225d3d0840

    • SHA1

      95054ea7916a1c004972c8d6c657b6da31143104

    • SHA256

      39644b49b99c9bc377b468c223000fd5446a71b679b285d2a88ea7d7ecea02fa

    • SHA512

      46dd14c8cec28a2ff6ab968705c2b3bac2cb5a99249d7380c6c3b8afba7a10163916276546ed9420f9f189cf6ffd8f2b953f9a0255294f778e5e0e0a83164117

    • SSDEEP

      24576:n39WkOyHutimZ9VSly2hVvHW6qMnSbTBBhBMN:39qHPkVOBTK

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojan

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks