General
-
Target
b8f70b0e7640bc7a6556b9db8a67229e0bdb95ce52ba6bb4c4cc5823d722bb4b
-
Size
3.9MB
-
Sample
250415-rkxl1ay1h1
-
MD5
420565bc2c05b356deef986cbd8c9369
-
SHA1
86b23f5f239c48dd796b0e6edb0a3918ade1f534
-
SHA256
b8f70b0e7640bc7a6556b9db8a67229e0bdb95ce52ba6bb4c4cc5823d722bb4b
-
SHA512
d88a57b544c0e95579ea7a16ed9f24b7caf5fb1a522e77f82a15e0bd7caa72672c083b87e3f7aac94dc6b5a1895d9effee5cd7a9bd1fe2fcb48b2edd3df04a58
-
SSDEEP
98304:CbJW/Moe49DlOZw7E5Tdi0K9w+UGZjLLGU4Ar8md5SsZ:WkxNDl2wA5Tdipuk5GU4vwJZ
Malware Config
Targets
-
-
Target
luoma2 (2).msi
-
Size
3.9MB
-
MD5
daa3ec4cd16303cd510f8c95ebbfb8fd
-
SHA1
304c9caf4edc41e9a0ecfd6115cc684f9e23a316
-
SHA256
65f0a236ce67ad31629c7f7826058a2ff2d7a0b01e9f965ef6559f7ad38bf78a
-
SHA512
0b53adb67a9d44791172c5b9c13ad47413a2eb30213d4584165477164321d03307e9da3d12edec73e76ee79297983419aaca6a9fadb2c2a5b273cd29f2990acc
-
SSDEEP
98304:18+N9QHCaCS1B1a/OxyzH7usEdKMUWnVf3CYk4p20B7Kk:1NKvFB1aOAzH7u1c6pCYk9A9
Score10/10-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Purplefox family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-