Detects PlugX payload

PlugX

PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

suricata: ET MALWARE PlugX CnC Beacon

suricata: ET MALWARE PlugX CnC Beacon

suricata: ET MALWARE PlugX/Destory HTTP traffic

suricata: ET MALWARE PlugX/Destory HTTP traffic

suricata: ET MALWARE Possible PlugX Common Header Struct

suricata: ET MALWARE Possible PlugX Common Header Struct

suricata: ET MALWARE UPDATE Protocol Trojan Communication detected on http ports 2

suricata: ET MALWARE UPDATE Protocol Trojan Communication detected on http ports 2

Blocklisted process makes network request

Executes dropped EXE

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.