Overview

overview

10

Static

static

3

1f3f731ad7...ea.exe

windows10-2004-x64

10

1f3f731ad7...ea.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1f3f731ad751c8e7002e7b77600f0ec96626a87315301240b4fd2f4a7bf938ea

  • Size

    692KB

  • Sample

    250416-pfh7ps1tg1

  • MD5

    585a121b7e7f38d2d42b9e1ba5fb8369

  • SHA1

    13d392436388a52ce3d4d2c54fe2bf620d7a6910

  • SHA256

    1f3f731ad751c8e7002e7b77600f0ec96626a87315301240b4fd2f4a7bf938ea

  • SHA512

    6e7d6df3f67c2b07bf0f458296442aedebbde2f7225b48fbc21bb1a4a59fc0ca7ca95cd9e9b66eec9686c9a78f3a69bb019b2725e5eed360063aaba1a0d91b49

  • SSDEEP

    12288:yi2cAro2HQVWAHkFSq2hAWJYlMUtrxlyuJVRe8yLnv+ri:yi2Tro2H2HESq2eWJ6MQjySjyLqi

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      1f3f731ad751c8e7002e7b77600f0ec96626a87315301240b4fd2f4a7bf938ea

    • Size

      692KB

    • MD5

      585a121b7e7f38d2d42b9e1ba5fb8369

    • SHA1

      13d392436388a52ce3d4d2c54fe2bf620d7a6910

    • SHA256

      1f3f731ad751c8e7002e7b77600f0ec96626a87315301240b4fd2f4a7bf938ea

    • SHA512

      6e7d6df3f67c2b07bf0f458296442aedebbde2f7225b48fbc21bb1a4a59fc0ca7ca95cd9e9b66eec9686c9a78f3a69bb019b2725e5eed360063aaba1a0d91b49

    • SSDEEP

      12288:yi2cAro2HQVWAHkFSq2hAWJYlMUtrxlyuJVRe8yLnv+ri:yi2Tro2H2HESq2eWJ6MQjySjyLqi

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks