Extracted

• • Target

    e861470fc6173cda004b16e48c9aea6eaba9a714a7f60f9235d4fe260bd92e92

  • Size

    1.7MB

  • MD5

    935a7eb2744b6e32408bfce6148ece45

  • SHA1

    9000f3663647c242eaea96691cf741a3ed45d284

  • SHA256

    e861470fc6173cda004b16e48c9aea6eaba9a714a7f60f9235d4fe260bd92e92

  • SHA512

    ce3182c2e9705fa60f7cdaa3893e0c8ac0639218dcb4beae07b909f976360fab744e9535e20c15a5255d927086a360faac76f3f1268c733bbcc4223a36a953e3

  Score

  10^/10

  plugxcollectiondiscoveryspywarestealertrojanupx

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx

  • PlugX Rat Payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook accounts

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2