General
- Target QQ.exe
- Size 807KB
- Sample260626-jagh2ahw81
- SHA256 f755d085c61879c1805115cdb6f344e9c8ff3b5f7b0e261cd59694c1d82dda18
Malware Config
Targets
-
- Target QQ.exe
- Size 807KB
- SHA256 f755d085c61879c1805115cdb6f344e9c8ff3b5f7b0e261cd59694c1d82dda18
Score10/10-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Gh0st RAT payload
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Server Software Component: Terminal Services DLL
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
5Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1