plugx

General

Target

8e0c7fabb2ed7c880f985e160f6e5fbdfc15bb645a8ae9701761cd70a582f997
Size

893KB
Sample

230129-ryptbace91
MD5

fcaba1be07ff24ecbc53df4eda744298
SHA1

5f793f1ec29377213eb80556b8819f7f7fefefdd
SHA256

8e0c7fabb2ed7c880f985e160f6e5fbdfc15bb645a8ae9701761cd70a582f997
SHA512

bcde87620a2590e05ac78b9a8777d1f6c51cfdc68b5a283ca15fdf7942cb288996c9d935b883d70aaca5f887f75ad5230304b263b69ad784a2f4d089cac2c9ae
SSDEEP

24576:lIbVFZC10w1sepi8Hx28WdNizMMTTdcvcCJM3pEGppDrIko:lILA1T1poMx28MNizMKor6uGp

Score

10^/10

Malware Config

Targets

- Target
  
  8e0c7fabb2ed7c880f985e160f6e5fbdfc15bb645a8ae9701761cd70a582f997
- Size
  
  893KB
- MD5
  
  fcaba1be07ff24ecbc53df4eda744298
- SHA1
  
  5f793f1ec29377213eb80556b8819f7f7fefefdd
- SHA256
  
  8e0c7fabb2ed7c880f985e160f6e5fbdfc15bb645a8ae9701761cd70a582f997
- SHA512
  
  bcde87620a2590e05ac78b9a8777d1f6c51cfdc68b5a283ca15fdf7942cb288996c9d935b883d70aaca5f887f75ad5230304b263b69ad784a2f4d089cac2c9ae
- SSDEEP
  
  24576:lIbVFZC10w1sepi8Hx28WdNizMMTTdcvcCJM3pEGppDrIko:lILA1T1poMx28MNizMKor6uGp
Score

10^/10

plugx redline vidar infostealer stealer trojan discovery
- Detects PlugX payload
- PlugX
  PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
  trojan plugx
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects PlugX payload

RedLine

Vidar

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2