Overview

overview

10

Static

static

3

cc46d6066e...76.exe

windows7-x64

10

cc46d6066e...76.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cc46d6066e9fbc6f0e0b19d7498a72c44c851844b557af932874453e2b872e76

  • Size

    491KB

  • Sample

    250129-vadb6atje1

  • MD5

    e92e272406c84d54aa572553c4f90895

  • SHA1

    e23e34c91355da8d72076e538f1863bd72090be5

  • SHA256

    cc46d6066e9fbc6f0e0b19d7498a72c44c851844b557af932874453e2b872e76

  • SHA512

    48dcf739c9fdc5837da8a150f7c40d5cedc30cec29799b1e8682ab7d0b6450778295acf68b6473871f553e0e97f7aa755e0bf72142008413c40f79012a9cecf8

  • SSDEEP

    12288:Wo2HQVWAHkFSq2hAWJYlMUtrxlyuJVRe8y3TbM1yD/P:Wo2H2HESq2eWJ6MQjySjy3TbCyrP

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      cc46d6066e9fbc6f0e0b19d7498a72c44c851844b557af932874453e2b872e76

    • Size

      491KB

    • MD5

      e92e272406c84d54aa572553c4f90895

    • SHA1

      e23e34c91355da8d72076e538f1863bd72090be5

    • SHA256

      cc46d6066e9fbc6f0e0b19d7498a72c44c851844b557af932874453e2b872e76

    • SHA512

      48dcf739c9fdc5837da8a150f7c40d5cedc30cec29799b1e8682ab7d0b6450778295acf68b6473871f553e0e97f7aa755e0bf72142008413c40f79012a9cecf8

    • SSDEEP

      12288:Wo2HQVWAHkFSq2hAWJYlMUtrxlyuJVRe8y3TbM1yD/P:Wo2H2HESq2eWJ6MQjySjy3TbCyrP

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks