plugx | 9442f513416e352b7b3e340a05541751d48f17fde61b1766bdd11f25bb13fcc2 | Triage

Submit
Reports

Overview

overview

Static

static

3

d104b4bd26...18.exe

windows7-x64

d104b4bd26...18.exe

windows10-2004-x64

Sharing

General

Target

d104b4bd268324c54a26d52cae69b691_JaffaCakes118
Size

244KB
Sample

240907-egrv5atfkg
MD5

d104b4bd268324c54a26d52cae69b691
SHA1

2e024c710ad76c632747b48d46afd1af3a2dbd25
SHA256

9442f513416e352b7b3e340a05541751d48f17fde61b1766bdd11f25bb13fcc2
SHA512

e54f3e2bd3eb4cc64a4ad55200f7f28d23e79267e60dfbb438f128cc24d7ff268b065554e870f926dba41938ddf678a13479d40eae95200bd3639d130af97d37
SSDEEP

3072:6wJjo1JaESMaP/pqLFNH3xVyWlEFITYS+5yARrSTpVPsibicyETEJypEkpTeVLOf:PESMSBGPy1GGveNs+ihEIJypEWTevu

Score

10^/10

plugx discovery trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

d104b4bd268324c54a26d52cae69b691_JaffaCakes118.exe

Resource

win7-20240704-en

plugx discovery trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

d104b4bd268324c54a26d52cae69b691_JaffaCakes118.exe

Resource

win10v2004-20240802-en

plugx discovery trojan

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  d104b4bd268324c54a26d52cae69b691_JaffaCakes118
- Size
  
  244KB
- MD5
  
  d104b4bd268324c54a26d52cae69b691
- SHA1
  
  2e024c710ad76c632747b48d46afd1af3a2dbd25
- SHA256
  
  9442f513416e352b7b3e340a05541751d48f17fde61b1766bdd11f25bb13fcc2
- SHA512
  
  e54f3e2bd3eb4cc64a4ad55200f7f28d23e79267e60dfbb438f128cc24d7ff268b065554e870f926dba41938ddf678a13479d40eae95200bd3639d130af97d37
- SSDEEP
  
  3072:6wJjo1JaESMaP/pqLFNH3xVyWlEFITYS+5yARrSTpVPsibicyETEJypEkpTeVLOf:PESMSBGPy1GGveNs+ihEIJypEWTevu
Score

10^/10

plugx discovery trojan
- Detects PlugX payload
- PlugX
  PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
  trojan plugx
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

plugxdiscoverytrojan

behavioral2

plugxdiscoverytrojan

© 2018-2024

Terms | Privacy