Overview

overview

10

Static

static

10

3bffabfb0d...31.exe

windows7-x64

10

3bffabfb0d...31.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3bffabfb0d72fe923255c00f3576bebd595a268efd9d45ec0a74d9a2fb74db31

  • Size

    1.4MB

  • Sample

    250119-ptagqaxncx

  • MD5

    16e72dc35f0cf131079915c3d55071f8

  • SHA1

    b17bbc55b7e9251043b4046d3235dcfb41f08be4

  • SHA256

    3bffabfb0d72fe923255c00f3576bebd595a268efd9d45ec0a74d9a2fb74db31

  • SHA512

    3dea85a0975242bf87e605e976487fb318a4a5b7e33dd26ce1247200bc7a45883e5053c92c24ce1ffd4848dd79084103092bfad96a042969b273e4de8d654146

  • SSDEEP

    24576:ri2Tro2H2HESq2eWJ6MQjySjykJQqmDrNKX5l5S3hBtUH+rBYuPQlwrz:rxTc2H2tFvduyStWqmVKXZAvO7

Score
10/10
blackmoongh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      3bffabfb0d72fe923255c00f3576bebd595a268efd9d45ec0a74d9a2fb74db31

    • Size

      1.4MB

    • MD5

      16e72dc35f0cf131079915c3d55071f8

    • SHA1

      b17bbc55b7e9251043b4046d3235dcfb41f08be4

    • SHA256

      3bffabfb0d72fe923255c00f3576bebd595a268efd9d45ec0a74d9a2fb74db31

    • SHA512

      3dea85a0975242bf87e605e976487fb318a4a5b7e33dd26ce1247200bc7a45883e5053c92c24ce1ffd4848dd79084103092bfad96a042969b273e4de8d654146

    • SSDEEP

      24576:ri2Tro2H2HESq2eWJ6MQjySjykJQqmDrNKX5l5S3hBtUH+rBYuPQlwrz:rxTc2H2tFvduyStWqmVKXZAvO7

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks