Overview

overview

10

Static

static

1

LZMA.exe

windows7-x64

10

LZMA.exe

windows10-1703-x64

10

LZMA.exe

windows10-2004-x64

10

LZMA.exe

windows11-21h2-x64

10

expatai.dll

windows7-x64

1

expatai.dll

windows10-1703-x64

1

expatai.dll

windows10-2004-x64

1

expatai.dll

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    CryptSvcser.rar
  • Size 565KB
  • Sample240218-tmaw5ace25
  • SHA256 9ff40de5a55aa6b5cf34c61acd52a26f77c6eb5cf1d464e0e651a046227a7b78
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
plugxtrojan

Malware Config

Targets

    • Target
      LZMA.exe
    • Size 388KB
    • SHA256 f7369777a4fee1b2e8282f30dc355c3216e4fdc7018912f2a7444026f9edafd0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    plugxtrojan

    • Detects PlugX payload

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

      trojanplugx

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    behavioral1behavioral2behavioral3behavioral4
    • Target
      expatai.dll
    • Size 400KB
    • SHA256 ed10a005bbab4385775e5964586bad0c1d267edbf87ce98feb3cc7135877cca1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5behavioral6behavioral7behavioral8

MITRE ATT&CK Matrix

Tasks