General

  • Target

    c6081f972b53eb18857fdcdebd5949b8afb87396f204e9535890e34eaaac8db4

  • Size

    10.5MB

  • Sample

    241228-n5dsvaxqav

  • MD5

    938c7f189a203550006d0f6a221554a4

  • SHA1

    758d8ea5b19cd626eaa05f8ed3b326b4f21d4caf

  • SHA256

    c6081f972b53eb18857fdcdebd5949b8afb87396f204e9535890e34eaaac8db4

  • SHA512

    9eefe8203ef9971024f7563d79456c374b97eed101a504f0978db2f230c30c7bf058ba5542f455240a3d81717b5af074638731a2f9c05476d3d6a7c03c5e7c91

  • SSDEEP

    12288:KhymnwJFPNdgBAEHApqePJN1AmLM7uVq9sShyEC:KUmwrl2Ao7sJNlM7ymsShQ

Malware Config

Targets

    • Target

      c6081f972b53eb18857fdcdebd5949b8afb87396f204e9535890e34eaaac8db4

    • Size

      10.5MB

    • MD5

      938c7f189a203550006d0f6a221554a4

    • SHA1

      758d8ea5b19cd626eaa05f8ed3b326b4f21d4caf

    • SHA256

      c6081f972b53eb18857fdcdebd5949b8afb87396f204e9535890e34eaaac8db4

    • SHA512

      9eefe8203ef9971024f7563d79456c374b97eed101a504f0978db2f230c30c7bf058ba5542f455240a3d81717b5af074638731a2f9c05476d3d6a7c03c5e7c91

    • SSDEEP

      12288:KhymnwJFPNdgBAEHApqePJN1AmLM7uVq9sShyEC:KUmwrl2Ao7sJNlM7ymsShQ

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Purplefox family

    • Drops file in Drivers directory

    • Sets service image path in registry

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.