Overview

overview

10

Static

static

3

7f015ba7bc...6a.exe

windows7-x64

10

7f015ba7bc...6a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7f015ba7bce743ee8f4f3a38534d5f4a1b4ef543be71bb471857a95e5c3e356a

  • Size

    2.0MB

  • Sample

    250227-bdvaasznz5

  • MD5

    932e7109e3435bc3f21ec9547d1eb0e6

  • SHA1

    6704cb3ca5de6529f478ba40e1baae374f8755da

  • SHA256

    7f015ba7bce743ee8f4f3a38534d5f4a1b4ef543be71bb471857a95e5c3e356a

  • SHA512

    9fb875a22099609172972a0a0c1cd93cfc754253a95b5161c58b3247476b1d33ce75014e74a364d4f21fb8fde697614d90ff993f758ba34c32e7cfc3e13ba32d

  • SSDEEP

    49152:m09XJt4HIN2H2tFvduySipe5giZPItx2apeapelI:XZJt4HINy2LkXy7tUvlI

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      7f015ba7bce743ee8f4f3a38534d5f4a1b4ef543be71bb471857a95e5c3e356a

    • Size

      2.0MB

    • MD5

      932e7109e3435bc3f21ec9547d1eb0e6

    • SHA1

      6704cb3ca5de6529f478ba40e1baae374f8755da

    • SHA256

      7f015ba7bce743ee8f4f3a38534d5f4a1b4ef543be71bb471857a95e5c3e356a

    • SHA512

      9fb875a22099609172972a0a0c1cd93cfc754253a95b5161c58b3247476b1d33ce75014e74a364d4f21fb8fde697614d90ff993f758ba34c32e7cfc3e13ba32d

    • SSDEEP

      49152:m09XJt4HIN2H2tFvduySipe5giZPItx2apeapelI:XZJt4HINy2LkXy7tUvlI

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks