Overview

overview

10

Static

static

1

8496e5d746...35.exe

windows7-x64

10

8496e5d746...35.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_34a2b9f979153d8ee8eb5141061665a9a06e96e573e3eecb02fb3f8eecdaae93

  • Size

    646KB

  • Sample

    241224-sthpwazqgv

  • MD5

    8bad2a3080c1f75305e4852d50f23671

  • SHA1

    733f68224ed80594a91d9e151570ae0583ef40b7

  • SHA256

    34a2b9f979153d8ee8eb5141061665a9a06e96e573e3eecb02fb3f8eecdaae93

  • SHA512

    eba44bcfde620846347254b02bed4e1c45db31c666155562d0d1faf037e45e9d29b3cf550f0255f2766ad47144ded5aaf75ee8e56fea30984ea307c65f4cf053

  • SSDEEP

    12288:fgCtDkBIHEyh0tGWqKArmcLEnNTXyebvkSJBMCJ0wKlZTJlALEqUET/oQtkIOyG:iBMEyuEWRcQTXyGsSJB6VZTJ6wzEzkIY

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojan

Malware Config

Targets

    • Target

      8496e5d746b87976c18e6de59fe0febf97218bfe87028499a5ebb9847281a835

    • Size

      1.4MB

    • MD5

      5af8688f2abe58dfefe8d2643c1cdbee

    • SHA1

      87322c1f85f9c3d692dd85780d355a7b73d0a24d

    • SHA256

      8496e5d746b87976c18e6de59fe0febf97218bfe87028499a5ebb9847281a835

    • SHA512

      a058e56ead41706fabae54bb8670f3121984c6aa2ce814752942284220caa67f66243473697c3dae19bcdbf749c261f89b6211b1f3fa8fdd803d72052b024670

    • SSDEEP

      24576:3ydQRKyY6ZZaVQRpdjJcwOUfuv1UtPGO0K48:3G5z6jJoyil8

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojan

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks