plugx | f3a0c0bd1c07624b327f633956215461ae57c8f197bb0c24c3742f8b3ff1d73d

Analysis

max time kernel
117s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 03:21

Target

f3a0c0bd1c07624b327f633956215461ae57c8f197bb0c24c3742f8b3ff1d73d.exe
Size

200KB
MD5

095f0b97eccdf581669fa5b36f662c80
SHA1

5c50415c6152593bb8a9524657765af36965603b
SHA256

f3a0c0bd1c07624b327f633956215461ae57c8f197bb0c24c3742f8b3ff1d73d
SHA512

80f5bf3d73b0274f3d614c5f6132027a228fdc06259b9f3f1546252eb844af0d390f378bb23fb009499abb385a15f9a023a35491cc5b9e35d715ac4b26c95f19
SSDEEP

3072:x0mZzbSFhXyTywpVEPjFOdoRXxcsPNTKtDHR:ymZqFIdTEPROd4xcZ9R

Score

10^/10

plugx trojan

Detects PlugX payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1900-54-0x00000000001C0000-0x00000000001F2000-memory.dmp	family_plugx
behavioral1/memory/1900-56-0x00000000001C0000-0x00000000001F2000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

C:\Users\Admin\AppData\Local\Temp\f3a0c0bd1c07624b327f633956215461ae57c8f197bb0c24c3742f8b3ff1d73d.exe
"C:\Users\Admin\AppData\Local\Temp\f3a0c0bd1c07624b327f633956215461ae57c8f197bb0c24c3742f8b3ff1d73d.exe"
1⤵
PID:1900

memory/1900-54-0x00000000001C0000-0x00000000001F2000-memory.dmp

Filesize
200KB

Download
memory/1900-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1900-56-0x00000000001C0000-0x00000000001F2000-memory.dmp

Filesize
200KB

Download