Hackers Distribute PurpleFox Malware Using Vulnerable MS-SQL Servers

The red fox malware has been active since 2018, adopting a brand fresh methodology to raise its payload through MS SQL servers.

The possibility actors target poorly managed MS SQL servers and net PowerShell commands to put in malicious MSI recordsdata and conceal themselves as a rootkit.

Pink Fox rootkit is an active malware advertising and marketing campaign that has been distributed using a fallacious malicious Telegram installer since early 2022.

AhnLab Security Emergency Response Heart (ASEC)  no longer too lengthy ago chanced on the PurpleFox malware being put in on poorly managed MS-SQL servers detected using its AhnLab Orderly Protection (ASD).

Assault Execution:

Before all the pieces, the possibility actors performed PowerShell through sqlservr.exe, an obfuscated PowerShell downloaded from the URL.

The downloaded PowerShell contains MsiMake, a characteristic written by the possibility actor, and the MsiMake instruct is performed in the arrangement to put in this MSI file.

Powershell no longer handiest installs MSI recordsdata but additionally contains an executable (Invoke-Tater) that could well also even be feeble to utilize a vulnerability and a PowerShell script.

Any other PowerShell script (Invoke-ReflectivePEInjection) permits you to bustle the malware recordsdata in a fileless blueprint.

As a end result, the possibility actor can install a malicious MSI file as an admin without user intervention using the PowerShell code.

The MSI file adjustments a registry key to net the PurpleFox malware with service privilege and to preserve its persistence.

The MSI equipment file adjustments a registry key for persistence and privilege escalation.

The possibility actors exercise this technique to agenda or delete or rename definite recordsdata and initiatives.

After a tool restart, the malicious code is performed by the usage of the Device Event Notification Device service (SENS service). Malware most incessantly installs a rootkit and objects up a service that can handiest be launched in safe mode.

Security administrators with entry to EDR arrangement can prevent malware from spreading by shutting down infection vectors earlier than they are exploited.

IOC

f725bab929df4fe2626849ba269b7fcb // MSI package d88a9237dd21653ebb155b035aa9a33c // Obfuscated PowerShell