Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-01-2025 07:55
General
-
Target
instacai.exe
-
Size
81.4MB
-
MD5
a7594c1aaa6ad63f5713467984c43f56
-
SHA1
0dbec6661b659262fb6fd383681637d561798345
-
SHA256
ce445c8619df81d6af32542e708c0f0610f9805d843d29beeb9759e92c87dc16
-
SHA512
86eb47fed4eec8c68728582337fefc3b04e3736b470fb7047e61377896ac6c37c8c5b383ec5c811b536b7ee2cad8874a8bb9e42c5d1e26dd5c6a65d882743945
-
SSDEEP
1572864:EIsFmG/LCRZCLYQUux91mt46TpmSHGErH5y0oBO/rWZqyljVnQ1nP:Rf0sQr1mt4WpmSzQBFR0
Malware Config
Signatures
-
Detect PurpleFox Rootkit 2 IoCs
Detect PurpleFox Rootkit.
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Purplefox family
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\instacai.exe"C:\Users\Admin\AppData\Local\Temp\instacai.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
-
Filesize
16.0MB