plugx | 09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0

Sharing

Copy URL Twitter E-mail

General

Target
09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0
Size 185KB
Sample240323-v2epashh74
SHA256 09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0
MD5 e15fc1136589422437e1cbb4c58abf13
SHA1 3f9ac7f863297eb300c5cc9224bfbfb9071ae13d
SHA512 e66615c9af558fe27cfadf27af23a09b3c1b31866e98c442dc48a6f4fed72400da3731b6353d477d64e587d63129c95de37d23d0dbdcdb4b4866f57805e6578a
SSDEEP 3072:Pui8BeS3MmdOwH6Yq8xWd84HQ5ijAELS9JkCXrq2dMKCurrXnYc6:Pui8Bp1Owrq8084HJAELyWCrLYx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

plugx

Malware Config

Signatures

Detects PlugX payload 1 IoCs

resource	yara_rule
sample	family_plugx

Plugx family
plugx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0

File Explorer

09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0

.dll 185KB

09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0

IMPHASH c49ddfe8cf4a554e966e2ff69cdfb069
SHA256 09fe5f3ebbbcb99225dadd2cfce76f9ca924fd49c05037450981055818743ad0
MD5 e15fc1136589422437e1cbb4c58abf13
SHA1 3f9ac7f863297eb300c5cc9224bfbfb9071ae13d
SHA512 e66615c9af558fe27cfadf27af23a09b3c1b31866e98c442dc48a6f4fed72400da3731b6353d477d64e587d63129c95de37d23d0dbdcdb4b4866f57805e6578a
SSDEEP 3072:Pui8BeS3MmdOwH6Yq8xWd84HQ5ijAELS9JkCXrq2dMKCurrXnYc6:Pui8Bp1Owrq8084HJAELyWCrLYx
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects PlugX payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6864

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

VirtualQueryEx CreateFileMappingW MapViewOfFile VirtualProtect GetFileAttributesW SetErrorMode OpenFileMappingW QueryDosDeviceW GetDriveTypeW GetVolumeInformationW GetDiskFreeSpaceExW FindFirstFileW FindClose FindNextFileW SetFilePointer SetEndOfFile FlushFileBuffers SetFileTime GetFileTime CreateDirectoryW ExpandEnvironmentStringsW GetLocalTime GetProcessHeap HeapFree lstrcpyW QueryPerformanceFrequency QueryPerformanceCounter CreateNamedPipeW ConnectNamedPipe GetOverlappedResult GetConsoleCP FreeConsole GetConsoleOutputCP GetConsoleWindow AllocConsole VirtualAllocEx SetConsoleScreenBufferSize GetStdHandle WriteConsoleInputW GenerateConsoleCtrlEvent GetConsoleMode GetConsoleDisplayMode GetConsoleCursorInfo GetConsoleScreenBufferInfo ReadConsoleOutputW GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW GetModuleHandleW RemoveDirectoryW GetComputerNameW ResumeThread lstrcpynA ResetEvent DisconnectNamedPipe CreateThread lstrcmpA ExitThread OutputDebugStringA LocalAlloc lstrcatW LocalFree FormatMessageA CreateIoCompletionPort PostQueuedCompletionStatus TerminateThread GetCurrentThread GetQueuedCompletionStatus LocalLock LocalUnlock LocalReAlloc SetLastError VirtualProtectEx GetModuleHandleA DeleteFileW OutputDebugStringW WriteProcessMemory ReadProcessMemory OpenProcess GetVersionExW GetCurrentThreadId SetUnhandledExceptionFilter DeleteCriticalSection InitializeCriticalSection MultiByteToWideChar WideCharToMultiByte lstrlenA lstrlenW WriteFile SetFileAttributesW ReadFile GetFileSize CreateFileW lstrcpyA lstrcmpW lstrcpynW WaitForMultipleObjects GetTickCount CreateEventW GetLastError CreateProcessW ExitProcess GetCurrentProcess TerminateProcess CreateMutexW QueueUserAPC GetExitCodeThread VirtualFree VirtualAlloc LeaveCriticalSection EnterCriticalSection GetSystemDefaultLCID GetSystemInfo GetSystemTime GlobalMemoryStatus VirtualFreeEx ProcessIdToSessionId CreateRemoteThread GetCurrentProcessId lstrcmpiW GetCommandLineW CloseHandle WaitForSingleObject SetEvent GetProcAddress LoadLibraryA SetConsoleCtrlHandler Sleep

user32

GetKeyState GetAsyncKeyState GetWindowThreadProcessId GetClassNameW GetWindowTextW GetForegroundWindow ExitWindowsEx DefWindowProcW CallNextHookEx UnhookWindowsHookEx DestroyIcon LoadCursorW ShowWindow PostQuitMessage KillTimer TranslateMessage GetMessageW SetWindowsHookExW SetTimer SetWindowLongW WindowFromPoint SetCapture SetCursorPos mouse_event keybd_event OpenWindowStationW GetProcessWindowStation SetProcessWindowStation OpenInputDesktop GetThreadDesktop SetThreadDesktop CloseWindowStation PostMessageA CreateWindowExW CloseDesktop CreateDesktopW GetSystemMetrics wsprintfA MessageBoxW wsprintfW GetIconInfo DispatchMessageW

gdi32

CreateDIBSection CreateCompatibleDC CreateCompatibleBitmap GdiFlush BitBlt GetDeviceCaps DeleteDC DeleteObject GetDIBits CreateDCW SelectObject

advapi32

RegOpenKeyExW DeleteService QueryServiceStatusEx CloseServiceHandle StartServiceW ChangeServiceConfig2W CreateServiceW OpenServiceW OpenSCManagerW RegCloseKey RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryValueExW EnumServicesStatusExW QueryServiceConfigW QueryServiceConfig2W ControlService ChangeServiceConfigW OpenProcessToken GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges GetUserNameW LookupAccountSidW GetLengthSid DuplicateTokenEx SetTokenInformation CreateProcessAsUserW RegEnumValueA ImpersonateLoggedOnUser RegOpenCurrentUser RegOverridePredefKey RevertToSelf RegEnumValueW InitiateSystemShutdownA

shell32

SHFileOperationW CommandLineToArgvW ExtractIconExW

odbc32

ord2 ord136 ord43 ord13 ord127 ord18 ord61 ord111 ord9 ord141 ord75 ord24 ord171 ord31 ord157

ws2_32

WSARecvFrom setsockopt WSAIoctl WSASocketA getsockname bind WSASendTo WSACleanup WSAGetLastError WSAStartup closesocket