Overview

overview

10

Static

static

1

918de40e8b...6f.exe

windows7_x64

10

918de40e8b...6f.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    918de40e8ba7e9c1ba555aa22c8acbfdf77f9c050d5ddcd7bd0e3221195c876f

  • Size

    1.2MB

  • Sample

    220128-ycxelabgfl

  • MD5

    e5a23e8a2c0f98850b1a43b595c08e63

  • SHA1

    9136eed34bea473d0f8554fb1d914502b832f219

  • SHA256

    918de40e8ba7e9c1ba555aa22c8acbfdf77f9c050d5ddcd7bd0e3221195c876f

  • SHA512

    cee90fc9c50cec6e41b1c14f1dfb3b25839fbb9f4e09c914343e673216e37f7e93f4a8a8e47cddfe841c4f0f122ba2a4f32bc8d673b9a882d92b0498748d3a6e

Score
10/10
plugxpersistencesuricatatrojan

Malware Config

Extracted

Family

plugx

C2

www.apple-net.com:80

www.apple-net.com:53

www.apple-net.com:8080

www.apple-net.com:443
Mutex

Attributes
  • folder

    Microsoft Malware ProtectionGCg

Targets

    • Target

      918de40e8ba7e9c1ba555aa22c8acbfdf77f9c050d5ddcd7bd0e3221195c876f

    • Size

      1.2MB

    • MD5

      e5a23e8a2c0f98850b1a43b595c08e63

    • SHA1

      9136eed34bea473d0f8554fb1d914502b832f219

    • SHA256

      918de40e8ba7e9c1ba555aa22c8acbfdf77f9c050d5ddcd7bd0e3221195c876f

    • SHA512

      cee90fc9c50cec6e41b1c14f1dfb3b25839fbb9f4e09c914343e673216e37f7e93f4a8a8e47cddfe841c4f0f122ba2a4f32bc8d673b9a882d92b0498748d3a6e

    Score
    10/10
    plugxpersistencesuricatatrojan

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

      trojanplugx

    • suricata: ET MALWARE APT Mustang Panda Payload - CnC Checkin

      suricata: ET MALWARE APT Mustang Panda Payload - CnC Checkin

      suricata

    • suricata: ET MALWARE Possible PlugX Common Header Struct

      suricata: ET MALWARE Possible PlugX Common Header Struct

      suricata

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks