Overview

overview

10

Static

static

3

AvastSvcZE...vc.exe

windows10-2004-x64

10

Resubmissions

14/10/2024, 13:09

241014-qd9sbawhrb10

14/10/2024, 13:03

241014-qagx5a1crn10

14/10/2024, 12:59

241014-p76gba1ckm10

14/10/2024, 12:57

241014-p63zsswfjd10

14/10/2024, 12:55

241014-p52qcawepe3

14/10/2024, 12:54

241014-p4832awelh3

14/10/2024, 12:52

241014-p35dfswejd10

Sharing

Copy URL Twitter E-mail

General

  • Target
    AvastSvcZEg.zip
  • Size 152KB
  • Sample241014-p35dfswejd
  • SHA256 72a7b8fe4b8401120124e8f9460bfd457fbf76b70a0c057b58ff271c5b2aadca
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
plugxdiscoverypersistencetrojan

Malware Config

Extracted

Family

  • plugx

C2

  • 103.56.53.46:80

  • 103.56.53.46:110

  • 103.56.53.46:443

  • 103.56.53.46:5938

Attributes
  • folder

    AvastSvcZEg

Targets

    • Target
      AvastSvcZEg/AvastSvc.exe
    • Size 60KB
    • SHA256 85ca20eeec3400c68a62639a01928a5dab824d2eadf589e5cbfe5a2bc41d9654
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    plugxdiscoverypersistencetrojan

    • PlugX

      PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

      trojanplugx

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks