Overview

overview

10

Static

static

3

Nv.exe

windows7-x64

10

Nv.exe

windows10-2004-x64

10

NvSmartMax.dll

windows7-x64

1

NvSmartMax.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    c56cac95726fd10b5a85be1c87336354.bin
  • Size 146KB
  • Sample240209-egbtxafe51
  • SHA256 e49e2826c4d9fae960ca6baecd6754400e5da74446c5b511beb15831b42f2b1d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
plugxpersistencetrojan

Malware Config

Targets

    • Target
      Nv.exe
    • Size 46KB
    • SHA256 523d28df917f9d265cd2c0d38df26277bc56a535145100ed82e6f5fdeaae7256
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    plugxpersistencetrojan

    • Detects PlugX payload

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

      trojanplugx

    • Modifies Installed Components in the registry

      persistence

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      NvSmartMax.dll
    • Size 20KB
    • SHA256 eaaa7899b37a3b04dcd02ad6d51e83e035be535f129773621ef0f399a2a98ee3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks