plugx | 09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0

Sharing

Copy URL

Twitter E-mail

General

Target

09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0
Size

185KB
MD5

e15fc1136589422437e1cbb4c58abf13
SHA1

3f9ac7f863297eb300c5cc9224bfbfb9071ae13d
SHA256

09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0
SHA512

e66615c9af558fe27cfadf27af23a09b3c1b31866e98c442dc48a6f4fed72400da3731b6353d477d64e587d63129c95de37d23d0dbdcdb4b4866f57805e6578a
SSDEEP

3072:Pui8BeS3MmdOwH6Yq8xWd84HQ5ijAELS9JkCXrq2dMKCurrXnYc6:Pui8Bp1Owrq8084HJAELyWCrLYx

Score

10^/10

plugx

Malware Config

Signatures

Detects PlugX payload 1 IoCs

resource	yara_rule
sample	family_plugx

Plugx family
plugx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0

Files

09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0
.dll windows:6 windows x86 arch:x86

c49ddfe8cf4a554e966e2ff69cdfb069

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualQueryEx
CreateFileMappingW
MapViewOfFile
VirtualProtect
GetFileAttributesW
SetErrorMode
OpenFileMappingW
QueryDosDeviceW
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
FindFirstFileW
FindClose
FindNextFileW
SetFilePointer
SetEndOfFile
FlushFileBuffers
SetFileTime
GetFileTime
CreateDirectoryW
ExpandEnvironmentStringsW
GetLocalTime
GetProcessHeap
HeapFree
lstrcpyW
QueryPerformanceFrequency
QueryPerformanceCounter
CreateNamedPipeW
ConnectNamedPipe
GetOverlappedResult
GetConsoleCP
FreeConsole
GetConsoleOutputCP
GetConsoleWindow
AllocConsole
VirtualAllocEx
SetConsoleScreenBufferSize
GetStdHandle
WriteConsoleInputW
GenerateConsoleCtrlEvent
GetConsoleMode
GetConsoleDisplayMode
GetConsoleCursorInfo
GetConsoleScreenBufferInfo
ReadConsoleOutputW
GetSystemDirectoryW
GetWindowsDirectoryW
GetModuleFileNameW
GetModuleHandleW
RemoveDirectoryW
GetComputerNameW
ResumeThread
lstrcpynA
ResetEvent
DisconnectNamedPipe
CreateThread
lstrcmpA
ExitThread
OutputDebugStringA
LocalAlloc
lstrcatW
LocalFree
FormatMessageA
CreateIoCompletionPort
PostQueuedCompletionStatus
TerminateThread
GetCurrentThread
GetQueuedCompletionStatus
LocalLock
LocalUnlock
LocalReAlloc
SetLastError
VirtualProtectEx
GetModuleHandleA
DeleteFileW
OutputDebugStringW
WriteProcessMemory
ReadProcessMemory
OpenProcess
GetVersionExW
GetCurrentThreadId
SetUnhandledExceptionFilter
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
lstrlenW
WriteFile
SetFileAttributesW
ReadFile
GetFileSize
CreateFileW
lstrcpyA
lstrcmpW
lstrcpynW
WaitForMultipleObjects
GetTickCount
CreateEventW
GetLastError
CreateProcessW
ExitProcess
GetCurrentProcess
TerminateProcess
CreateMutexW
QueueUserAPC
GetExitCodeThread
VirtualFree
VirtualAlloc
LeaveCriticalSection
EnterCriticalSection
GetSystemDefaultLCID
GetSystemInfo
GetSystemTime
GlobalMemoryStatus
VirtualFreeEx
ProcessIdToSessionId
CreateRemoteThread
GetCurrentProcessId
lstrcmpiW
GetCommandLineW
CloseHandle
WaitForSingleObject
SetEvent
GetProcAddress
LoadLibraryA
SetConsoleCtrlHandler
Sleep

user32

GetKeyState
GetAsyncKeyState
GetWindowThreadProcessId
GetClassNameW
GetWindowTextW
GetForegroundWindow
ExitWindowsEx
DefWindowProcW
CallNextHookEx
UnhookWindowsHookEx
DestroyIcon
LoadCursorW
ShowWindow
PostQuitMessage
KillTimer
TranslateMessage
GetMessageW
SetWindowsHookExW
SetTimer
SetWindowLongW
WindowFromPoint
SetCapture
SetCursorPos
mouse_event
keybd_event
OpenWindowStationW
GetProcessWindowStation
SetProcessWindowStation
OpenInputDesktop
GetThreadDesktop
SetThreadDesktop
CloseWindowStation
PostMessageA
CreateWindowExW
CloseDesktop
CreateDesktopW
GetSystemMetrics
wsprintfA
MessageBoxW
wsprintfW
GetIconInfo
DispatchMessageW

gdi32

CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
GdiFlush
BitBlt
GetDeviceCaps
DeleteDC
DeleteObject
GetDIBits
CreateDCW
SelectObject

advapi32

RegOpenKeyExW
DeleteService
QueryServiceStatusEx
CloseServiceHandle
StartServiceW
ChangeServiceConfig2W
CreateServiceW
OpenServiceW
OpenSCManagerW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryValueExW
EnumServicesStatusExW
QueryServiceConfigW
QueryServiceConfig2W
ControlService
ChangeServiceConfigW
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
RegDeleteValueW
LookupPrivilegeValueW
AdjustTokenPrivileges
GetUserNameW
LookupAccountSidW
GetLengthSid
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserW
RegEnumValueA
ImpersonateLoggedOnUser
RegOpenCurrentUser
RegOverridePredefKey
RevertToSelf
RegEnumValueW
InitiateSystemShutdownA

shell32

SHFileOperationW
CommandLineToArgvW
ExtractIconExW

odbc32

ord2
ord136
ord43
ord13
ord127
ord18
ord61
ord111
ord9
ord141
ord75
ord24
ord171
ord31
ord157

ws2_32

WSARecvFrom
setsockopt
WSAIoctl
WSASocketA
getsockname
bind
WSASendTo
WSACleanup
WSAGetLastError
WSAStartup
closesocket

Sections

.text
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c49ddfe8cf4a554e966e2ff69cdfb069

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

odbc32

ws2_32

Sections

.text Size: 155KB - Virtual size: 155KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 1024B - Virtual size: 16KB

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 155KB - Virtual size: 155KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 1024B - Virtual size: 16KB

.reloc
Size: 11KB - Virtual size: 10KB