‘Purple Fox’ Fileless Malware Delivered by Rig Exploit Kit Now Abuses PowerShell

guest · Sep 9, 2019

‘Purple Fox’ Fileless Malware with Rookit Component Delivered by Rig Exploit Kit Now Abuses PowerShell
September 9, 2019
https://blog.trendmicro.com/trendla...red-by-rig-exploit-kit-now-abuses-powershell/

The Rig exploit kit, for instance, is known for delivering various payloads — such as downloader trojans, ransomware, cryptocurrency-mining malware, and information stealers — whose arrival and delivery techniques are also constantly fine-tuned.

The Purple Fox fileless downloader malware, which was reported to have at least affected 30,000 users last year, is a recent example. Also delivered by the Rig exploit kit, Purple Fox previously used the Nullsoft Scriptable Install System (NSIS) tool to retrieve and execute its payload.

It retains its rootkit component by abusing publicly available code. It now also eschews its use of NSIS in favor of abusing PowerShell, making Purple Fox capable of fileless infection. It also incorporated additional exploits to its infection chain, most likely as a foolproof mechanism to ensure that it can still infect the system.
Purple Fox is a downloader malware; besides retrieving and executing cryptocurrency-mining threats, it can also deliver other kinds of malware.
Click to expand...

Circuit · Sep 9, 2019

PowerShell has been blocked by OS armor and AppGuard.
No worries for now.

Peter2150 · Sep 9, 2019

Circuit said: ↑

PowerShell has been blocked by OS armor and AppGuard.
No worries for now.
Click to expand...

Yep

guest · Jul 6, 2020

Purple Fox EK Adds Microsoft Exploits to Arsenal
Two exploits for Microsoft vulnerabilities have been added to the Purple Fox EK, showing ongoing development
July 6, 2020
https://threatpost.com/microsoft-exploits-purple-fox-ek/157157/

The Purple Fox exploit kit (EK) has added two new exploits targeting critical- and high-severity Microsoft vulnerabilities to its bag of tricks – and researchers say they expect more attacks to be added in the future.

The Purple Fox EK was previously analyzed in September, when researchers said that it appears to have been built to replace the Rig EK in the distribution chain of Purple Fox malware, which is a trojan/rootkit. The latest revision to the exploit kit has added attacks against flaws tracked as CVE-2020-0674 and CVE-2019-1458, which were first disclosed at the end of 2019 and early 2020.

“This tells us that the authors of Purple Fox are staying up to date on viable exploitable vulnerabilities and updating when they become available,” said researchers with Proofpoint in a Monday analysis. “It’s reasonable to expect that they will continue to update as new vulnerabilities are discovered.”
Click to expand...

Proofpoint: Purple Fox EK Adds Exploits for CVE-2020-0674 and CVE-2019-1458 to its Arsenal

Purple Fox is an exploit kit (EK) that appears to have been built to replace the RIG exploit kit (EK) in the distribution chain of Purple Fox malware (a Trojan/Rootkit). By building their own EK for distribution, the authors of the Purple Fox malware are able to save money by no longer paying for the Rig EK.

Exploit Kits are not as prevalent as they were a few years ago. However, they are still part of the threat landscape. One thing that hasn’t changed regarding exploit kits is the way in which exploit kit authors regularly update to include new attacks against newly discovered vulnerabilities.
These two things together show us that the threat actors behind the Purple Fox malware are active malware developers who take a professional approach by looking to save money and keep their product current.
Click to expand...

Log in or Sign up

‘Purple Fox’ Fileless Malware Delivered by Rig Exploit Kit Now Abuses PowerShell

guest Guest

Circuit Registered Member

Peter2150 Global Moderator

guest Guest

Log in or Sign up

‘Purple Fox’ Fileless Malware Delivered by Rig Exploit Kit Now Abuses PowerShell

guest Guest

Circuit Registered Member

Peter2150 Global Moderator

guest Guest

Useful Searches