Extracted

• • Target
    a057a61b026cf031deb4bf89907181bcbe53b8595f5a959a4d5d45801c723110
  • Size 5.4MB
  • SHA256 a057a61b026cf031deb4bf89907181bcbe53b8595f5a959a4d5d45801c723110
  • MD5 ccf4652cc0a297643894f815459ffad3
  • SHA1 51b1a5e652a8590a1c60b5e0cad4e79fd39244b8
  • SHA512 1050c9a9df8f4f4a6ed88794cf126ac45d9cc8282f5c9988db6dce8a6fec2c50446ff212084f127fc3cdf3b6c9364f8525de9e48f5280a744a7d34a3d62099ce
  • SSDEEP 98304:hGdVyVT9nOgmh3Dmn2pnsmtk2aPkLXGuUMfc1T0aV3bWfLjC6VG2MOrb+vOJUpAd:eWT9nO7VmnuLfLXGuFk1ZwCpS+/1O
  • TLSH
    T182461253F5C184B3C1251B344CAB6374C8367E652F31594FABE9FE4D2E3A680A83616B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutiongh0stratpurplefoxxredpersistenceratrootkittrojanupxmacro

  • Detect PurpleFox Rootkit

    Detect PurpleFox Rootkit.

    rootkit

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Family: PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Gh0st RAT payload

  • Drops file in Drivers directory

  • Server Software Component: Terminal Services DLL

    persistence

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2