plugx

General

Target

ad9efa458ada665935b0bf189f8f75ee.exe
Size

4.3MB
Sample

210607-4854cnxe8j
MD5

ad9efa458ada665935b0bf189f8f75ee
SHA1

91157e08154f6761d400d1b7b380202127c7c89d
SHA256

0c8ad3a0485e2edad4d5cdde99d34434d79233c131edd06e6efa25f8bc86037e
SHA512

63a5b2162960660f125bea23653a00af0925d4bcd520c80305b089b5685b887a41ad9c4170489865067868a32504dbd2492066f8fe4021b97d4514c3471a5787

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

SEL5

C2

157.90.251.148:53294

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/

rc4.i32

Targets

- Target
  
  ad9efa458ada665935b0bf189f8f75ee.exe
- Size
  
  4.3MB
- MD5
  
  ad9efa458ada665935b0bf189f8f75ee
- SHA1
  
  91157e08154f6761d400d1b7b380202127c7c89d
- SHA256
  
  0c8ad3a0485e2edad4d5cdde99d34434d79233c131edd06e6efa25f8bc86037e
- SHA512
  
  63a5b2162960660f125bea23653a00af0925d4bcd520c80305b089b5685b887a41ad9c4170489865067868a32504dbd2492066f8fe4021b97d4514c3471a5787
Score

10^/10

aspackv2 upx plugx redline smokeloader vidar sel5 backdoor infostealer stealer trojan vmprotect
- PlugX
  PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
  trojan plugx
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2