plugx | da01734bacb716ac303f3018d3c4cf7fdc0784d157bb99976bd3d5a51381d34e | Triage

Submit
Reports

Overview

overview

Static

static

3

e696b38ac7...18.exe

windows7-x64

e696b38ac7...18.exe

windows10-2004-x64

Sharing

General

Target

e696b38ac71b23f50ee68da06a004af3_JaffaCakes118
Size

675KB
Sample

240917-l77slaxerm
MD5

e696b38ac71b23f50ee68da06a004af3
SHA1

480e3fe49e3acb71e1a466e8ba2d02997eaf278e
SHA256

da01734bacb716ac303f3018d3c4cf7fdc0784d157bb99976bd3d5a51381d34e
SHA512

7373f4ae19a732058e923172482d2b15fb8bed784431b734bfd3822c29b4369bc67a94804d00d0004f9ff7781f0db5eab4c4bf0f7cdf6f97d38f44a238bd709f
SSDEEP

12288:jat0EAH49n8Bm1zXC9YWP1W/zkObvcparNFzgnfFuQvJWzcI7On1hIRlhnXqyZx:2t24V1zgYbL1fFzgfF7Wr7O1e5Tx

Score

10^/10

plugx discovery trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e696b38ac71b23f50ee68da06a004af3_JaffaCakes118.exe

Resource

win7-20240903-en

plugx discovery trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

e696b38ac71b23f50ee68da06a004af3_JaffaCakes118.exe

Resource

win10v2004-20240802-en

plugx discovery trojan

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  e696b38ac71b23f50ee68da06a004af3_JaffaCakes118
- Size
  
  675KB
- MD5
  
  e696b38ac71b23f50ee68da06a004af3
- SHA1
  
  480e3fe49e3acb71e1a466e8ba2d02997eaf278e
- SHA256
  
  da01734bacb716ac303f3018d3c4cf7fdc0784d157bb99976bd3d5a51381d34e
- SHA512
  
  7373f4ae19a732058e923172482d2b15fb8bed784431b734bfd3822c29b4369bc67a94804d00d0004f9ff7781f0db5eab4c4bf0f7cdf6f97d38f44a238bd709f
- SSDEEP
  
  12288:jat0EAH49n8Bm1zXC9YWP1W/zkObvcparNFzgnfFuQvJWzcI7On1hIRlhnXqyZx:2t24V1zgYbL1fFzgfF7Wr7O1e5Tx
Score

10^/10

plugx discovery trojan
- Detects PlugX payload
- PlugX
  PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
  trojan plugx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

plugxdiscoverytrojan

behavioral2

plugxdiscoverytrojan

© 2018-2024

Terms | Privacy