Analysis
-
max time kernel
0s -
max time network
3s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
29/03/2025, 00:48
General
-
Target
0a871ab9a5865eb80c0d54abfc77ccf5004b0aff6b801fe6203281f0b1f5c5ee.exe
-
Size
1.2MB
-
MD5
fbf850a35a9cb04f52c053b51ab42e18
-
SHA1
03587bd774a0e160e4d49d965bb936746a460798
-
SHA256
0a871ab9a5865eb80c0d54abfc77ccf5004b0aff6b801fe6203281f0b1f5c5ee
-
SHA512
15312257c2bc822434c04d778f19e807c95003c6d2f0a0bc02ed796bd849f38e6c68ff18e0e79d1e9ba34674870a7429826ddbfd7a4cc77b3fb834c6eb280de1
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtip:WIwgMEuy+inDfp3/XoCw57XYBwKp
Malware Config
Signatures
-
Detect PurpleFox Rootkit 5 IoCs
Detect PurpleFox Rootkit.
-
Gh0st RAT payload 7 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Purplefox family
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a871ab9a5865eb80c0d54abfc77ccf5004b0aff6b801fe6203281f0b1f5c5ee.exe"C:\Users\Admin\AppData\Local\Temp\0a871ab9a5865eb80c0d54abfc77ccf5004b0aff6b801fe6203281f0b1f5c5ee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\AK47.exe"C:\Users\Admin\AppData\Local\Temp\AK47.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AK47.exeC:\Users\Admin\AppData\Local\Temp\\AK47.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\AK74.exeC:\Users\Admin\AppData\Local\Temp\\AK74.exe2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\AK74.exe > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\Ghiya.exeC:\Windows\SysWOW64\Ghiya.exe -auto1⤵
-
C:\Windows\SysWOW64\Ghiya.exeC:\Windows\SysWOW64\Ghiya.exe -acsi2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD5423eb994ed553294f8a6813619b8da87
SHA1eca6a16ccd13adcfc27bc1041ddef97ec8081255
SHA256050b4f2d5ae8eaecd414318dc8e222a56f169626da6ca8feb7edd78e8b1f0218
SHA512fab0a9af8031c242c486de373df7277c8b0e39f7a0c9c2ac2e385dbd3ea67be16e91b128287634f76131e5264149ab1b452cd21df4c4895e8c4efc8d8cf99095
-
Filesize
400KB
MD5b0998aa7d5071d33daa5b60b9c3c9735
SHA19365a1ff0c6de244d6f36c8d84072cc916665d3c
SHA2563080b6bb456564899b0d99d4131bd6a0b284d31f7d80ef773e4872d94048d49a
SHA512308c13cda9fea39b980ae686f44afd9090e9cb8970fffc4436320e0d09a31aee5e656914e0121fe888098a14c52749716fa04980396fd6ac70a88c11cbb6b850
-
Filesize
49KB
MD56b26e3b9bd2fccb70fdbda54eb577b3b
SHA19d9f5a14b20e17218d64367ad5fab9ad54989d3d
SHA2569d321c639347c8175ebe56b581a86411f7d6222fba595558f23fe56659ef29c7
SHA5123c820901230acef5728a7bb0ccc98de6c9b669f61575597bd96efdc806958b102de2470420fb875fc075ec92dc571285ac07ccafce3ae5f688b6c50eff99b772
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB