Purple Fox Malware targets Windows by Worms

A new Purple Fox Malware infection vector puts Windows systems, facing the Internet at risk from the brute effect of SMB passwords. 

This Malware targets Windows devices through phishing , to add new "worm" capabilities.

Purple Fox Malware History

Purple Fox Malware, last appeared in 2018, recently required user interaction, or some kind of third-party tool to infect Windows by adding new functionality, that can brute force its way into victims’ Pcs automatically.

Purple Fox Malware Tactics

The new infection, can be breached through SMB password brute force, also includes a rootkit that allows to hide the malware in the system, and make it difficult to detect and remove.

Once the worm infects a victim’s Pc, will create a new service that managed by some URLs.

Purple Fox using a previous tactic to infect machines with malware through a phishing campaign, by sending the payload via email to exploit a browser vulnerability.

Once the MSI installer package is executed, it will launch by impersonating a Windows Update package along with Chinese text. These Chinese letters are randomly generated between each different MSI installer to create a different hash, and make it difficult to create links between different versions of the same MSI.

the installer will extract the payloads and decrypt them from Chinese letters within the MSI package.

This process will include modifying the Windows firewall, in such a way as to prevent the infected machine from being re infected, or to be exploited by a different threat actor.

Video to watch