Overview

overview

10

Static

static

1d12af334a...71.exe

windows7_x64

9

1d12af334a...71.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d12af334a427a690811c675e7c5981352d237741473480c7d4d4f0abdf5e371

  • Size

    421KB

  • Sample

    210517-jxdms6a5c2

  • MD5

    c5772cc7dce580af79be14997361f7d1

  • SHA1

    1c3831dad29e13a5f49257710d03fe9fc54a76ae

  • SHA256

    1d12af334a427a690811c675e7c5981352d237741473480c7d4d4f0abdf5e371

  • SHA512

    6bed43fd3e2c05a03913b4197b9d9a0d5270c56a5aca18ab1b1346b24a1218c1fe484d8ae50c5f615901039bcf5007bcfd5639e661bbe46b3b9cad74e8800473

Score
10/10
plugxpersistencetrojanupx

Malware Config

Targets

    • Target

      1d12af334a427a690811c675e7c5981352d237741473480c7d4d4f0abdf5e371

    • Size

      421KB

    • MD5

      c5772cc7dce580af79be14997361f7d1

    • SHA1

      1c3831dad29e13a5f49257710d03fe9fc54a76ae

    • SHA256

      1d12af334a427a690811c675e7c5981352d237741473480c7d4d4f0abdf5e371

    • SHA512

      6bed43fd3e2c05a03913b4197b9d9a0d5270c56a5aca18ab1b1346b24a1218c1fe484d8ae50c5f615901039bcf5007bcfd5639e661bbe46b3b9cad74e8800473

    Score
    10/10
    persistenceupxplugxtrojan

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

      trojanplugx

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Modifies AppInit DLL entries

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks