General
- Target 05a758b314743aebe0da1bbb8d3b87833d238446e2b5e61c2ab75c44ff0da94f
- Size 2.2MB
- Sample261110-rdh52afh64
- SHA256 05a758b314743aebe0da1bbb8d3b87833d238446e2b5e61c2ab75c44ff0da94f
Malware Config
Targets
-
- Target 05a758b314743aebe0da1bbb8d3b87833d238446e2b5e61c2ab75c44ff0da94f
- Size 2.2MB
- SHA256 05a758b314743aebe0da1bbb8d3b87833d238446e2b5e61c2ab75c44ff0da94f
Score10/10Detect PurpleFox Rootkit
Detect PurpleFox Rootkit.
Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
Family: PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
Gh0st RAT payload
Drops file in Drivers directory
Server Software Component: Terminal Services DLL
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
Executes dropped EXE
Loads dropped DLL
Drops file in System32 directory
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Masquerading
1Match Legitimate Name or Location
1Modify Registry
1