Overview

overview

10

Static

static

3

d9a5b5942b...63.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d9a5b5942b59ca5d06fcf0cd180be9703d8bb67278aa751bbe85cb2ea6772a63

  • Size

    2.4MB

  • Sample

    250403-pmz4sswwcw

  • MD5

    7fe144958cad790f3bc24842c7df659a

  • SHA1

    28e2c3c28479a3b8b39fe58b2c16ee26b475f5c7

  • SHA256

    d9a5b5942b59ca5d06fcf0cd180be9703d8bb67278aa751bbe85cb2ea6772a63

  • SHA512

    5ac443f72e1d6c1e6d9ff943d88766e46ccd688a1232e9c918366585947219015ecd392a31dbc3253ae49408856ca08a4a0f649a24a24b71fa947ce6c3b5c20f

  • SSDEEP

    49152:x2hu3wWLkSNn16adVi2thaK4haxtsJ1r0qgO41F8yuF13/SyfmsP1w8m2s2/:Skka1djthh4hdJ109z8yuF1qyfmsP1wk

Score
10/10
gh0stratpurplefoxdiscoveryratrootkittrojan

Malware Config

Targets

    • Target

      d9a5b5942b59ca5d06fcf0cd180be9703d8bb67278aa751bbe85cb2ea6772a63

    • Size

      2.4MB

    • MD5

      7fe144958cad790f3bc24842c7df659a

    • SHA1

      28e2c3c28479a3b8b39fe58b2c16ee26b475f5c7

    • SHA256

      d9a5b5942b59ca5d06fcf0cd180be9703d8bb67278aa751bbe85cb2ea6772a63

    • SHA512

      5ac443f72e1d6c1e6d9ff943d88766e46ccd688a1232e9c918366585947219015ecd392a31dbc3253ae49408856ca08a4a0f649a24a24b71fa947ce6c3b5c20f

    • SSDEEP

      49152:x2hu3wWLkSNn16adVi2thaK4haxtsJ1r0qgO41F8yuF13/SyfmsP1w8m2s2/:Skka1djthh4hdJ109z8yuF1qyfmsP1wk

    Score
    10/10
    gh0stratpurplefoxdiscoveryratrootkittrojan

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks