General
- Target b0710ab21acadd2d3c295c0dd9a5134082f1c1f3b5ed7d426d3bc31e366bb773
- Size 1.2MB
- Sample260420-sr2d7sd18m
- SHA256 b0710ab21acadd2d3c295c0dd9a5134082f1c1f3b5ed7d426d3bc31e366bb773
Score
10/10
Malware Config
Targets
-
- Target b0710ab21acadd2d3c295c0dd9a5134082f1c1f3b5ed7d426d3bc31e366bb773
- Size 1.2MB
- SHA256 b0710ab21acadd2d3c295c0dd9a5134082f1c1f3b5ed7d426d3bc31e366bb773
Score10/10Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
Gh0st RAT payload
Drops file in Drivers directory
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
Executes dropped EXE
Drops file in System32 directory
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1