Overview

overview

10

Static

static

3

550c6315df...12.exe

windows7-x64

10

550c6315df...12.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    550c6315dff85c84ca551e9c4880526f3bf436917ccfa238cf848e8f70e3bd12

  • Size

    1.3MB

  • Sample

    241213-y4jmtayjcs

  • MD5

    64fe7f4a0bcd9fa4b00c2d26171f9525

  • SHA1

    8423b0333775cc752f35df50ce7f1178a34037dd

  • SHA256

    550c6315dff85c84ca551e9c4880526f3bf436917ccfa238cf848e8f70e3bd12

  • SHA512

    5ca4793562312c8df2779eb7c08a012408b4c13f63ef71adfd722858bc3351ff94ba38a340998d9ef5cff45ab4be218ed6dbdac24f6f92bf318fb07c0b92e48a

  • SSDEEP

    24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNR:QHPkVOBTK

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojan

Malware Config

Targets

    • Target

      550c6315dff85c84ca551e9c4880526f3bf436917ccfa238cf848e8f70e3bd12

    • Size

      1.3MB

    • MD5

      64fe7f4a0bcd9fa4b00c2d26171f9525

    • SHA1

      8423b0333775cc752f35df50ce7f1178a34037dd

    • SHA256

      550c6315dff85c84ca551e9c4880526f3bf436917ccfa238cf848e8f70e3bd12

    • SHA512

      5ca4793562312c8df2779eb7c08a012408b4c13f63ef71adfd722858bc3351ff94ba38a340998d9ef5cff45ab4be218ed6dbdac24f6f92bf318fb07c0b92e48a

    • SSDEEP

      24576:dOyHutimZ9VSly2hVvHW6qMnSbTBBhBMNR:QHPkVOBTK

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojan

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks