plugx | 1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f | Triage

Submit
Reports

Overview

overview

Static

static

3

f0be554b1d...18.exe

windows7-x64

f0be554b1d...18.exe

windows10-2004-x64

Sharing

General

Target

f0be554b1d9b394bc2a90322ca944fce_JaffaCakes118
Size

148KB
Sample

240921-2gqdmaxgjd
MD5

f0be554b1d9b394bc2a90322ca944fce
SHA1

89bda0569dc5a83fa5e024fbe1e4338361e79719
SHA256

1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f
SHA512

3da7baf6b4933c90c47376ec065097de1bc2be54b44d8558d3250d620d459c9a22d74b642b33caac62321217977a55e9381e615c8cb7c3d7a15c58ff9ca136d1
SSDEEP

3072:pZpnEqYRxCen7tHPr8LeThj71IgnCbHDSsYZVSXwQwdgeZ:zpn8TCuz8iThecCnSxZVSXFwdg

Score

10^/10

plugx discovery persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

f0be554b1d9b394bc2a90322ca944fce_JaffaCakes118.exe

Resource

win7-20240903-en

plugx discovery persistence trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

f0be554b1d9b394bc2a90322ca944fce_JaffaCakes118.exe

Resource

win10v2004-20240802-en

plugx discovery persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  f0be554b1d9b394bc2a90322ca944fce_JaffaCakes118
- Size
  
  148KB
- MD5
  
  f0be554b1d9b394bc2a90322ca944fce
- SHA1
  
  89bda0569dc5a83fa5e024fbe1e4338361e79719
- SHA256
  
  1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f
- SHA512
  
  3da7baf6b4933c90c47376ec065097de1bc2be54b44d8558d3250d620d459c9a22d74b642b33caac62321217977a55e9381e615c8cb7c3d7a15c58ff9ca136d1
- SSDEEP
  
  3072:pZpnEqYRxCen7tHPr8LeThj71IgnCbHDSsYZVSXwQwdgeZ:zpn8TCuz8iThecCnSxZVSXFwdg
Score

10^/10

plugx discovery persistence trojan
- Detects PlugX payload
- PlugX
  PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
  trojan plugx
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

plugxdiscoverypersistencetrojan

behavioral2

plugxdiscoverypersistencetrojan

© 2018-2024

Terms | Privacy