General
- Target ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9
- Size 4.9MB
- Sample260903-mk8xta1vdv
- SHA256 ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9
Malware Config
Targets
-
- Target ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9
- Size 4.9MB
- SHA256 ed14bcf9c752696001d3778485f346ba2de78510d7a20d3b2a707a65cebc11a9
Score10/10-
Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
-
Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
-
Gh0st RAT payload
-
Drops file in Drivers directory
-
Server Software Component: Terminal Services DLL
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Discovery
Browser Information Discovery
1Query Registry
2Remote System Discovery
1System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1