General
-
Target
https://googleads.g.doubleclick.net/pcs/click?xai=AKAOjsv2vuOnmIpmr_mLhkgONSveBWv7W_LkDDpTJgyKA601Bb6JOEgdKaBfTTjbXZm2iHeNJB78tPjs3GzOMMbbqU_K4Mxvtbo3WN97dWBc6v8_h3gHwHEcmP08fheyaUwr2KHUohaD3MRLBQhGSBu2SPfrx7qUE4u1zh_YaPJmCTmd3M49aXejdJGu-VUKpYBTPzs1pHUKyaPthIqrM030VHHTAD32g_Lv9RUSrgttUy81FFO60FlmePCWQlbrj-yx4KDQAcr--w_-7h_AaR4u5oB2niDdOErVvJEmvNuXeTMVYL1jLbRFNu_Awj-brXZm&sig=Cg0ArKJSzBBxNgtKJMhe&fbs_aeid=[gw_fbsaeid]&adurl=https://www.asakurachieko.com/A/[email protected]
-
Sample
220314-srd9nsbacr
Malware Config
Targets
-
-
Target
https://googleads.g.doubleclick.net/pcs/click?xai=AKAOjsv2vuOnmIpmr_mLhkgONSveBWv7W_LkDDpTJgyKA601Bb6JOEgdKaBfTTjbXZm2iHeNJB78tPjs3GzOMMbbqU_K4Mxvtbo3WN97dWBc6v8_h3gHwHEcmP08fheyaUwr2KHUohaD3MRLBQhGSBu2SPfrx7qUE4u1zh_YaPJmCTmd3M49aXejdJGu-VUKpYBTPzs1pHUKyaPthIqrM030VHHTAD32g_Lv9RUSrgttUy81FFO60FlmePCWQlbrj-yx4KDQAcr--w_-7h_AaR4u5oB2niDdOErVvJEmvNuXeTMVYL1jLbRFNu_Awj-brXZm&sig=Cg0ArKJSzBBxNgtKJMhe&fbs_aeid=[gw_fbsaeid]&adurl=https://www.asakurachieko.com/A/[email protected]
Score10/10-
PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
-
PlugX Rat Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-