General

  • Target

    f1d23eac841a920f8677dbf2e4ab2b74fbf37bc6bbeb4824edfe0457d3b15394

  • Size

    2.7MB

  • Sample

    241228-hrbhnsxjfp

  • MD5

    309551f40bf2e6b3c4cb241907cbb8c8

  • SHA1

    94179e87d777addffd9108123c580405ad6df3dd

  • SHA256

    f1d23eac841a920f8677dbf2e4ab2b74fbf37bc6bbeb4824edfe0457d3b15394

  • SHA512

    9a141f653d27b8c2bc0d6f07d6fe9bf20f3bc572c132f76e64adc774e5fd6161332f88c0cbed16b9c6a78cd3ea5f387e56c33f8e6da6efb15d6406a053a32e16

  • SSDEEP

    49152:OCwsbCANnKXferL7Vwe/Gg0P+WhIsABTu8SF3eBpc/:pws2ANnKXOaeOgmhI1BTundeBpc/

Malware Config

Targets

    • Target

      f1d23eac841a920f8677dbf2e4ab2b74fbf37bc6bbeb4824edfe0457d3b15394

    • Size

      2.7MB

    • MD5

      309551f40bf2e6b3c4cb241907cbb8c8

    • SHA1

      94179e87d777addffd9108123c580405ad6df3dd

    • SHA256

      f1d23eac841a920f8677dbf2e4ab2b74fbf37bc6bbeb4824edfe0457d3b15394

    • SHA512

      9a141f653d27b8c2bc0d6f07d6fe9bf20f3bc572c132f76e64adc774e5fd6161332f88c0cbed16b9c6a78cd3ea5f387e56c33f8e6da6efb15d6406a053a32e16

    • SSDEEP

      49152:OCwsbCANnKXferL7Vwe/Gg0P+WhIsABTu8SF3eBpc/:pws2ANnKXOaeOgmhI1BTundeBpc/

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Purplefox family

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.