Overview

overview

10

Static

static

3

arpReport.exe

windows7-x64

10

arpReport.exe

windows10-2004-x64

10

arphadump.dll

windows7-x64

3

arphadump.dll

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    ArainsToolser.zip
  • Size 3.0MB
  • Sample240911-bysbfaxarf
  • SHA256 d2727538c887f2f523a637d6385d68b125d60935b4084512fb3e1eba47e70c76
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
plugxdiscoverytrojan

Malware Config

Targets

    • Target
      arpReport.exe
    • Size 189KB
    • SHA256 6840e6e2a2b4555db025c331b41d426387e8d6397fd5917fad29d3893fb1886f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    plugxdiscoverytrojan

    • Detects PlugX payload

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

      trojanplugx

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Deletes itself

    behavioral1behavioral2
    • Target
      arphadump.dll
    • Size 7.2MB
    • SHA256 9e10d98024db6f6748433918288232cc1e55bea916146729be40dc0e53615393
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks