General

  • Target

    37a915c929f351f25efa2aa50261395873b42c07d14e4a4e6adc1d7c9c694f6e

  • Size

    2.5MB

  • Sample

    241212-x895wsxjfj

  • MD5

    aa7b56f88d4ce32a5d73027fc772e997

  • SHA1

    2dcaec9b41c6f3fbd4f371d477129c07f67c22cc

  • SHA256

    37a915c929f351f25efa2aa50261395873b42c07d14e4a4e6adc1d7c9c694f6e

  • SHA512

    018260c5a9aff181ec8f1de9c811f38301207fb2f575de4268b63c0c3460d8f191ea27637dcba934542f0f2a43d567aa5fe0182915d92452f9d9850446d97329

  • SSDEEP

    24576:bCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH8:bCwsbCANnKXferL7Vwe/Gg0P+Whc67

Malware Config

Targets

    • Target

      37a915c929f351f25efa2aa50261395873b42c07d14e4a4e6adc1d7c9c694f6e

    • Size

      2.5MB

    • MD5

      aa7b56f88d4ce32a5d73027fc772e997

    • SHA1

      2dcaec9b41c6f3fbd4f371d477129c07f67c22cc

    • SHA256

      37a915c929f351f25efa2aa50261395873b42c07d14e4a4e6adc1d7c9c694f6e

    • SHA512

      018260c5a9aff181ec8f1de9c811f38301207fb2f575de4268b63c0c3460d8f191ea27637dcba934542f0f2a43d567aa5fe0182915d92452f9d9850446d97329

    • SSDEEP

      24576:bCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH8:bCwsbCANnKXferL7Vwe/Gg0P+Whc67

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Purplefox family

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.