Overview

overview

10

Static

static

9ba3a12dff...6a.exe

windows7-x64

10

9ba3a12dff...6a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ba3a12dff7a578baa1834cdacfcd55b6dbea0a3c2393ae937d2a88a3064a96a

  • Size

    333KB

  • Sample

    221130-3yda3afh52

  • MD5

    4cf40352cbcf8120b64bb0d6b61f4a29

  • SHA1

    fe4838673ad99d2b0ee4171a3ec9210a934c32b2

  • SHA256

    9ba3a12dff7a578baa1834cdacfcd55b6dbea0a3c2393ae937d2a88a3064a96a

  • SHA512

    a3cdcf8d51f383f27b0d79ec3ecd050d7f0f2187ad04b33320999c31292f77bb5b20901271c89699b8864bc1302a8260852eb3cd53f1ab9d73e500e0ac89a2f1

  • SSDEEP

    6144:Cz+92mhAMJ/cPl3iNGhPnYxgYhWtxiPwZyM/bz5P:CK2mhAMJ/cPl/WgHQMjzF

Score
10/10
plugxtrojan

Malware Config

Targets

    • Target

      9ba3a12dff7a578baa1834cdacfcd55b6dbea0a3c2393ae937d2a88a3064a96a

    • Size

      333KB

    • MD5

      4cf40352cbcf8120b64bb0d6b61f4a29

    • SHA1

      fe4838673ad99d2b0ee4171a3ec9210a934c32b2

    • SHA256

      9ba3a12dff7a578baa1834cdacfcd55b6dbea0a3c2393ae937d2a88a3064a96a

    • SHA512

      a3cdcf8d51f383f27b0d79ec3ecd050d7f0f2187ad04b33320999c31292f77bb5b20901271c89699b8864bc1302a8260852eb3cd53f1ab9d73e500e0ac89a2f1

    • SSDEEP

      6144:Cz+92mhAMJ/cPl3iNGhPnYxgYhWtxiPwZyM/bz5P:CK2mhAMJ/cPl/WgHQMjzF

    Score
    10/10
    plugxtrojan

    • Detects PlugX payload

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

      trojanplugx

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks