Overview

overview

10

Static

static

3

8cca596253...a9.exe

windows7-x64

10

8cca596253...a9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8cca596253bb36dc82b1c26d593104ca5b463f72cebc8a6df1009176a25244a9

  • Size

    6.6MB

  • Sample

    241229-b4anksylfk

  • MD5

    2da98083b16bd806de655adbbdf92bb7

  • SHA1

    d5bcb682b67fb43fae314c54db8a78548c94f0fc

  • SHA256

    8cca596253bb36dc82b1c26d593104ca5b463f72cebc8a6df1009176a25244a9

  • SHA512

    9a57a83aee6e37d70a90b4bfb62dd79ccd6989b22ded7e894d23f983d0d12a5e0419590235c8725601473532bed55462cdbfba6883d44acae2188a631aa10a73

  • SSDEEP

    98304:pws2ANnKXOaeOgmhI1BTu6/TdfylkLXLjy+Iq6+pCF5s2Pd+CifyBJNBdq:bKXbeO7S1p5dfylkmw6+y5s2F+vKH0

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      8cca596253bb36dc82b1c26d593104ca5b463f72cebc8a6df1009176a25244a9

    • Size

      6.6MB

    • MD5

      2da98083b16bd806de655adbbdf92bb7

    • SHA1

      d5bcb682b67fb43fae314c54db8a78548c94f0fc

    • SHA256

      8cca596253bb36dc82b1c26d593104ca5b463f72cebc8a6df1009176a25244a9

    • SHA512

      9a57a83aee6e37d70a90b4bfb62dd79ccd6989b22ded7e894d23f983d0d12a5e0419590235c8725601473532bed55462cdbfba6883d44acae2188a631aa10a73

    • SSDEEP

      98304:pws2ANnKXOaeOgmhI1BTu6/TdfylkLXLjy+Iq6+pCF5s2Pd+CifyBJNBdq:bKXbeO7S1p5dfylkmw6+y5s2F+vKH0

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

      persistence

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks