Extracted

• • Target

    AvastSvcZEg/AvastSvc.exe

  • Size

    60KB

  • MD5

    a72036f635cecf0dcb1e9c6f49a8fa5b

  • SHA1

    049813b955db1dd90952657ae2bd34250153563e

  • SHA256

    85ca20eeec3400c68a62639a01928a5dab824d2eadf589e5cbfe5a2bc41d9654

  • SHA512

    e3582e0969361d272c2469ce139ec809b9b0ac98fbc5eb5bb287442aed4c6ba69ed8175b68970751c93730cfaf07b75c3bc5e4e24aeda8f984b24f33bb8e3da2

  • SSDEEP

    768:Q/WQ3/TymxfsHYPry0bgYh3LKgMoCDGFh9D:Q+QvT7xUHYPDbgYVLWofD

  Score

  10^/10

  plugxdiscoverypersistencetrojan

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1