General

  • Target

    c82cf070175449f991e3249310a21a5df1ff23990918dd85b51131147ec00b96

  • Size

    2.6MB

  • Sample

    250703-gp615avnv9

  • MD5

    30963c12a961c8d6f4a51baa2a144832

  • SHA1

    7dbfbd6bdedfa7ec1d2b7c0d3485f27e5c62a53f

  • SHA256

    c82cf070175449f991e3249310a21a5df1ff23990918dd85b51131147ec00b96

  • SHA512

    94d12f1ded546f404d454ed3614ceca803b15327e6969b42a2d789025d29b3e193aa8335344cf50acf098cfab38bac60c5f5375a538cbc3b42a6dce7b7f16204

  • SSDEEP

    24576:OCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHQ:OCwsbCANnKXferL7Vwe/Gg0P+WhB1

Malware Config

Targets

    • Target

      c82cf070175449f991e3249310a21a5df1ff23990918dd85b51131147ec00b96

    • Size

      2.6MB

    • MD5

      30963c12a961c8d6f4a51baa2a144832

    • SHA1

      7dbfbd6bdedfa7ec1d2b7c0d3485f27e5c62a53f

    • SHA256

      c82cf070175449f991e3249310a21a5df1ff23990918dd85b51131147ec00b96

    • SHA512

      94d12f1ded546f404d454ed3614ceca803b15327e6969b42a2d789025d29b3e193aa8335344cf50acf098cfab38bac60c5f5375a538cbc3b42a6dce7b7f16204

    • SSDEEP

      24576:OCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHQ:OCwsbCANnKXferL7Vwe/Gg0P+WhB1

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Purplefox family

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v16

Tasks