Overview

overview

10

Static

static

3

737a77f2dc...47.exe

windows7-x64

10

737a77f2dc...47.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    737a77f2dcf031fa49b9985c58f7acb16663c19baf4c75f6ac998e49e9316747

  • Size

    4.1MB

  • Sample

    240705-fyj3aawbpg

  • MD5

    8190c0a1b9ea731687aa40a8f7069096

  • SHA1

    5041fcc23bac4e89073ee12177cb3c3f04004829

  • SHA256

    737a77f2dcf031fa49b9985c58f7acb16663c19baf4c75f6ac998e49e9316747

  • SHA512

    d9e81e8c73f6a7dd5e7d710947bb79421c765bfc2739836f4e8a3569ee6f033881bf8def34be02061f65dd95d58b80760b49ccc26b41a308a0a45df31208491c

  • SSDEEP

    49152:fCwsbCANnKXferL7Vwe/Gg0P+Whjy1hXJEIptTc6IfAyL4UMYMZ2RtB:Kws2ANnKXOaeOgmhIX6IA9oycUMYM

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      737a77f2dcf031fa49b9985c58f7acb16663c19baf4c75f6ac998e49e9316747

    • Size

      4.1MB

    • MD5

      8190c0a1b9ea731687aa40a8f7069096

    • SHA1

      5041fcc23bac4e89073ee12177cb3c3f04004829

    • SHA256

      737a77f2dcf031fa49b9985c58f7acb16663c19baf4c75f6ac998e49e9316747

    • SHA512

      d9e81e8c73f6a7dd5e7d710947bb79421c765bfc2739836f4e8a3569ee6f033881bf8def34be02061f65dd95d58b80760b49ccc26b41a308a0a45df31208491c

    • SSDEEP

      49152:fCwsbCANnKXferL7Vwe/Gg0P+Whjy1hXJEIptTc6IfAyL4UMYMZ2RtB:Kws2ANnKXOaeOgmhIX6IA9oycUMYM

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

      persistence

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Server Software Component

1
T1505

Terminal Services DLL

1
T1505.005

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks