Overview

overview

10

Static

static

3

639777d513...43.exe

windows10-2004-x64

10

639777d513...43.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    639777d51312abbe56d758cb19e63081b1abe74f9ac7fdd61dc39125d3beec43

  • Size

    2.4MB

  • Sample

    250419-khrjms1tez

  • MD5

    cdd91e3d1807768dc01b7a78a11d2c5c

  • SHA1

    2e9dccf622efcf85648951b57d140b4bfc56554c

  • SHA256

    639777d51312abbe56d758cb19e63081b1abe74f9ac7fdd61dc39125d3beec43

  • SHA512

    5e7ca002456db446c08aee7141614355de37fcbd3b900e4db0a839421205ecd830bb8052b7262f785963268187a8084c2e4251b40cfff545fd0d3275188b6604

  • SSDEEP

    24576:BCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHu:BCwsbCANnKXferL7Vwe/Gg0P+WhPb

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      639777d51312abbe56d758cb19e63081b1abe74f9ac7fdd61dc39125d3beec43

    • Size

      2.4MB

    • MD5

      cdd91e3d1807768dc01b7a78a11d2c5c

    • SHA1

      2e9dccf622efcf85648951b57d140b4bfc56554c

    • SHA256

      639777d51312abbe56d758cb19e63081b1abe74f9ac7fdd61dc39125d3beec43

    • SHA512

      5e7ca002456db446c08aee7141614355de37fcbd3b900e4db0a839421205ecd830bb8052b7262f785963268187a8084c2e4251b40cfff545fd0d3275188b6604

    • SSDEEP

      24576:BCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHu:BCwsbCANnKXferL7Vwe/Gg0P+WhPb

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

      persistence

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks