Overview

overview

10

Static

static

3

b5be4a5b25...1c.exe

windows7-x64

10

b5be4a5b25...1c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5be4a5b25efae7343e65f462e4a6c84e5d7cc4d65759f51c603365a1c3f8c1c

  • Size

    572KB

  • Sample

    250129-lr2xeasmek

  • MD5

    456b0f63f1a86540c2fed5fe5bcd6b42

  • SHA1

    45b7b91abce340b0d99b9951d76bb8b58eaa4bd7

  • SHA256

    b5be4a5b25efae7343e65f462e4a6c84e5d7cc4d65759f51c603365a1c3f8c1c

  • SHA512

    f4efde1eaae9ec7792ce7c8cc38e66aa484983eb54332f4994e6c07c8fd926095117b72b391973d8757ee2f8015519f66ba1fa4cfc4acbc1b0fddf73b626654c

  • SSDEEP

    12288:7i2cAro2HQVWAHkFSq2hAWJYlMUtrxlyuJVRe8ykH:7i2Tro2H2HESq2eWJ6MQjySjykH

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      b5be4a5b25efae7343e65f462e4a6c84e5d7cc4d65759f51c603365a1c3f8c1c

    • Size

      572KB

    • MD5

      456b0f63f1a86540c2fed5fe5bcd6b42

    • SHA1

      45b7b91abce340b0d99b9951d76bb8b58eaa4bd7

    • SHA256

      b5be4a5b25efae7343e65f462e4a6c84e5d7cc4d65759f51c603365a1c3f8c1c

    • SHA512

      f4efde1eaae9ec7792ce7c8cc38e66aa484983eb54332f4994e6c07c8fd926095117b72b391973d8757ee2f8015519f66ba1fa4cfc4acbc1b0fddf73b626654c

    • SSDEEP

      12288:7i2cAro2HQVWAHkFSq2hAWJYlMUtrxlyuJVRe8ykH:7i2Tro2H2HESq2eWJ6MQjySjykH

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks