Overview

overview

10

Static

static

3

ca9dbf12c0...0a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca9dbf12c0739ef2c167c5e6b6eff27783dddbcc5b92b6be0fbab709662f720a

  • Size

    1.5MB

  • Sample

    250401-qgs9qsyzds

  • MD5

    66653546e70334af1706f22ee465e76d

  • SHA1

    f2c2af3d0d6726f4e50df8baf586336079ca6d6a

  • SHA256

    ca9dbf12c0739ef2c167c5e6b6eff27783dddbcc5b92b6be0fbab709662f720a

  • SHA512

    bd804c5baa937b306fe5ad258141a0a662979143526e650492e1919587b701d122209829051873d7a8ed48ca03a2a44c99a1dbf04ba0d74fc77d17e58c79eac7

  • SSDEEP

    24576:VOeh7E7IJbtEJEHng8wGrQTLq73xaH7pbHnI2m:VOWFJbtSMXoTLq73xKTI2m

Score
10/10
gh0stratpurplefoxdiscoveryratrootkittrojan

Malware Config

Targets

    • Target

      ca9dbf12c0739ef2c167c5e6b6eff27783dddbcc5b92b6be0fbab709662f720a

    • Size

      1.5MB

    • MD5

      66653546e70334af1706f22ee465e76d

    • SHA1

      f2c2af3d0d6726f4e50df8baf586336079ca6d6a

    • SHA256

      ca9dbf12c0739ef2c167c5e6b6eff27783dddbcc5b92b6be0fbab709662f720a

    • SHA512

      bd804c5baa937b306fe5ad258141a0a662979143526e650492e1919587b701d122209829051873d7a8ed48ca03a2a44c99a1dbf04ba0d74fc77d17e58c79eac7

    • SSDEEP

      24576:VOeh7E7IJbtEJEHng8wGrQTLq73xaH7pbHnI2m:VOWFJbtSMXoTLq73xKTI2m

    Score
    10/10
    gh0stratpurplefoxdiscoveryratrootkittrojan

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks