plugx | 9250660cbb79a033d53de8cf0540982cdd1addbc57f05c8a300eab86c6d1920c | Triage

Submit
Reports

Overview

overview

Static

static

1

plugx/4094...ba.exe

windows7-x64

7

plugx/4094...ba.exe

windows10-2004-x64

7

plugx/5a94...11.exe

windows7-x64

1

plugx/5a94...11.exe

windows10-2004-x64

1

plugx/8df2...43.exe

windows7-x64

plugx/8df2...43.exe

windows10-2004-x64

plugx/9aff...0d.exe

windows7-x64

1

plugx/9aff...0d.exe

windows10-2004-x64

1

plugx/a2a0...5d.exe

windows7-x64

1

plugx/a2a0...5d.exe

windows10-2004-x64

1

plugx/a8e2...a3.exe

windows7-x64

plugx/a8e2...a3.exe

windows10-2004-x64

plugx/ac75...f2.exe

windows7-x64

7

plugx/ac75...f2.exe

windows10-2004-x64

7

Sharing

General

Target

plugx.zip
Size

1.5MB
Sample

230412-g98epaad98
MD5

1b6dfabb30dafd6a8a5e4d9afe1c7317
SHA1

e295f0402d349d999f5c9539cfaf20fddb24d698
SHA256

9250660cbb79a033d53de8cf0540982cdd1addbc57f05c8a300eab86c6d1920c
SHA512

c65e31c593b671da0da69944537a81a87aaa08b7b4414ce2f0bf0a14372728710d863ace12b3b3916b67a582a5005d62e281ced968c65ffe60eb9f3f5e7f5fe3
SSDEEP

24576:cFKuD1SndvJa5WtYmXIwBLmz2o6Q8fj43IDW1lB0ZdnxYYqG0qoMkTedjIJDW1l+:cFHodv7tVIwBLo22gDW1lC36YuqoJRJR

Score

10^/10

plugx aspackv2 trojan

Static task

static1

Behavioral task

behavioral1

Sample

plugx/4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe

Resource

win7-20230220-en

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

plugx/4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.exe

Resource

win10v2004-20230220-en

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral3

Sample

plugx/5a9468a87997f2363995e264505105f6a235b66543bb28635fb74f78704e9111.exe

Resource

win7-20230220-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral4

Sample

plugx/5a9468a87997f2363995e264505105f6a235b66543bb28635fb74f78704e9111.exe

Resource

win10v2004-20230220-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral5

Sample

plugx/8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe

Resource

win7-20230220-en

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral6

Sample

plugx/8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.exe

Resource

win10v2004-20230221-en

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral7

Sample

plugx/9aff1e12a1b447ca8ab3076f684716a859c906f9b2d0e870d59d0f06fc548d0d.exe

Resource

win7-20230220-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

plugx/9aff1e12a1b447ca8ab3076f684716a859c906f9b2d0e870d59d0f06fc548d0d.exe

Resource

win10v2004-20230220-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral9

Sample

plugx/a2a0ce67c239385c1ec1d5d29ff91a7daf91cf2b4368dc91d84dbb598becdc5d.exe

Resource

win7-20230220-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral10

Sample

plugx/a2a0ce67c239385c1ec1d5d29ff91a7daf91cf2b4368dc91d84dbb598becdc5d.exe

Resource

win10v2004-20230220-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral11

Sample

plugx/a8e2b38c576bf19f6b0bed69c85c2a64445337087257cf566388f7b0d6d583a3.exe

Resource

win7-20230220-en

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral12

Sample

plugx/a8e2b38c576bf19f6b0bed69c85c2a64445337087257cf566388f7b0d6d583a3.exe

Resource

win10v2004-20230220-en

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral13

Sample

plugx/ac758e6ad91120d1c98248ed2582c1ab472d83ef354f9c4b2f62167a699565f2.exe

Resource

win7-20230220-en

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral14

Sample

plugx/ac758e6ad91120d1c98248ed2582c1ab472d83ef354f9c4b2f62167a699565f2.exe

Resource

win10v2004-20230220-en

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  plugx/4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba.bin
- Size
  
  665KB
- MD5
  
  6741ad202dcef693dceb98b0a10c49fc
- SHA1
  
  b1e8ba2c12908c338a1b38c61cc7dab17015bd01
- SHA256
  
  4094db927542c7b1d4a770d30231fcc34687a47058821001f4a46808692fcdba
- SHA512
  
  1a6f82a5ea41d72b1493ab5cf358249b8018e4cdebe15d6a2f63e202a092779a5f40647bac0b0f9d8556383160b82add9a6205a84aaf43eeb30922761a034f49
- SSDEEP
  
  12288:n1IIZygwpE/1UZyMYUkUJIh8E2tFNgw/nK6iUDbD/W/TQ2Y6s/z:nuIIgN1UZp/Ja52tEKnK6pfKLQ2Y6s7
Score

7^/10

aspackv2
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
behavioral1 behavioral2
- Target
  
  plugx/5a9468a87997f2363995e264505105f6a235b66543bb28635fb74f78704e9111.bin
- Size
  
  203KB
- MD5
  
  75758f7b5ce71fa918c1c7c68d3bd524
- SHA1
  
  4a6ac65f6f8304bacbf176fce156cc0393aae565
- SHA256
  
  5a9468a87997f2363995e264505105f6a235b66543bb28635fb74f78704e9111
- SHA512
  
  0d6ee5345777439f69fb5b49ef7ba7687bc40467d618f77e1c81ba08ef645e1596f3019496b2df7e229ae1f274edb17cdc81124a7ca0a6478a157ca6865fae7a
- SSDEEP
  
  6144:NGfHWURWwbPxPDlbQsgMZZ/fu7FIRVFIV9Uc7PWW:YvWURWwbPx9QA/ftBI1J
Score

1^/10
behavioral3 behavioral4
- Target
  
  plugx/8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143.bin
- Size
  
  267KB
- MD5
  
  ec3a003082a19fd6a00f84df315d18a2
- SHA1
  
  e7268a6982c3d17aaf472b331b67fbdbc4000dec
- SHA256
  
  8df2949d77aff0ef84af7c2a892602e05d3518d85b87fa5ed56493199efd2143
- SHA512
  
  d3e804add5ebf3efdbf4794cbc1cc53bfc0485298771a1f43d7d683870f82561be3387d83436cf308e260bd600ce475998add0d094d63ab46f3dd75ad16f74aa
- SSDEEP
  
  6144:yz+92mhAMJ/cPl3ieBLVcFtRbUN5T+ZjOEGdjP/Z17jsjnvlmVr:yK2mhAMJ/cPlfcFnU6kdZUnvYF
Score

10^/10

plugx trojan
- Detects PlugX payload
- PlugX
  PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
  trojan plugx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
behavioral5 behavioral6
- Target
  
  plugx/9aff1e12a1b447ca8ab3076f684716a859c906f9b2d0e870d59d0f06fc548d0d.bin
- Size
  
  201KB
- MD5
  
  9c616ead0699110365ca354bd5f828af
- SHA1
  
  e0ec398d6ef3cbede98c6b9741a20db5c1358332
- SHA256
  
  9aff1e12a1b447ca8ab3076f684716a859c906f9b2d0e870d59d0f06fc548d0d
- SHA512
  
  8de44dc9b05203f546c1447e610f5502b3e7f550f92606b3d8fe1d4ae875d67c78b0c1267e4a6d0560b26074d25c85376163db8743156785f0bf0372e750534d
- SSDEEP
  
  6144:HGjE0F/c4P+6l/0MY1CDXuoFE9lwj4Ejd7PWn:HoE0F/c4PN0+DXKgj4EZ8
Score

1^/10
behavioral7 behavioral8
- Target
  
  plugx/a2a0ce67c239385c1ec1d5d29ff91a7daf91cf2b4368dc91d84dbb598becdc5d.bin
- Size
  
  203KB
- MD5
  
  d5ee933f4eb7e3226b454dd2efcf2609
- SHA1
  
  8644fdc023ed3b37f121600f45a187b89dcc67b8
- SHA256
  
  a2a0ce67c239385c1ec1d5d29ff91a7daf91cf2b4368dc91d84dbb598becdc5d
- SHA512
  
  7e483cc88d703fe9ccec78feaa1c47bc98688d1917045847d709040eadffdb038aafe98624e8b71280a44b6792c2efce28893d3478cd80d7b676df9a9225e0c3
- SSDEEP
  
  6144:zXtu8+/0JWzIblasnMZZ/fuoFIRVlw5M6Z7PWW:z9u8+/0JWz/sU/f2xw5M2J
Score

1^/10
behavioral10 behavioral9
- Target
  
  plugx/a8e2b38c576bf19f6b0bed69c85c2a64445337087257cf566388f7b0d6d583a3.bin
- Size
  
  267KB
- MD5
  
  e99b341dfd3147e5bbb385e7cc5e5e17
- SHA1
  
  e5d152281a61be6db5f3d8d42d985210c4faf283
- SHA256
  
  a8e2b38c576bf19f6b0bed69c85c2a64445337087257cf566388f7b0d6d583a3
- SHA512
  
  74d9a6d521dcc6a74c47511185efa3d026d72ee03e4986fb700c1c0555a5511cc7f2c85de9ad2da6373683f3578275c3f7561f664115bfaa054be32b05bcd14c
- SSDEEP
  
  6144:yz+92mhAMJ/cPl3ieBLVcFtRbUN5T+ZjOEGdjPrZ17jsjnvlmVe:yK2mhAMJ/cPlfcFnU6kdZonvYQ
Score

10^/10

plugx trojan
- Detects PlugX payload
- PlugX
  PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
  trojan plugx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  
  plugx/ac758e6ad91120d1c98248ed2582c1ab472d83ef354f9c4b2f62167a699565f2.bin
- Size
  
  146KB
- MD5
  
  f1d6ee923099c9f1b10d563e6146cb87
- SHA1
  
  605590582a3714d21b48a874c68df15abfb4b190
- SHA256
  
  ac758e6ad91120d1c98248ed2582c1ab472d83ef354f9c4b2f62167a699565f2
- SHA512
  
  f4a4910ba6e0392fcfb08fbbff895b043d392ea4ce4377c3a2a07bb94f166509525441928f33c24c3d8e1e67a4d0a66294c714c319062ecd3ad742c7e48e205a
- SSDEEP
  
  3072:Zq3baagC6laxrPPtBUeqc/44KBqEspsExs62pNUYO:Zq3bakvrPXt1OseExz2pH
Score

7^/10
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
behavioral13 behavioral14

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

© 2018-2025

Terms | Privacy