plugx | 4b71451551fc49cb793675c1333df2023a2b0dfd67976a5ebe52600524794f01 | Triage

Submit
Reports

Overview

overview

Static

static

3

4b71451551...01.exe

windows7-x64

4b71451551...01.exe

windows10-2004-x64

Sharing

General

Target

4b71451551fc49cb793675c1333df2023a2b0dfd67976a5ebe52600524794f01
Size

263KB
Sample

250103-vbvb3atlcw
MD5

582fb65add01ce95d827b96006a3ff42
SHA1

d8931a791f8ef3d4015aec2bffa47808e28877b5
SHA256

4b71451551fc49cb793675c1333df2023a2b0dfd67976a5ebe52600524794f01
SHA512

6e2194abfba98c6723040b9d4e801a8d4e75cc8449d408638fa80edfa11865cad9d01b768c21919ed863f3e7f97d258930ccbbf6acbc0e65c730ead79f5c7141
SSDEEP

6144:iz+92mhAMJ/cPl3i+eLba0WZj+ufaZef6IMLWKH1cLb1UyOr0Sg3:iK2mhAMJ/cPlQIFXfaZefAyb1FOB2

Score

10^/10

plugx discovery trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

4b71451551fc49cb793675c1333df2023a2b0dfd67976a5ebe52600524794f01.exe

Resource

win7-20240903-en

plugx discovery trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

4b71451551fc49cb793675c1333df2023a2b0dfd67976a5ebe52600524794f01.exe

Resource

win10v2004-20241007-en

plugx discovery trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  4b71451551fc49cb793675c1333df2023a2b0dfd67976a5ebe52600524794f01
- Size
  
  263KB
- MD5
  
  582fb65add01ce95d827b96006a3ff42
- SHA1
  
  d8931a791f8ef3d4015aec2bffa47808e28877b5
- SHA256
  
  4b71451551fc49cb793675c1333df2023a2b0dfd67976a5ebe52600524794f01
- SHA512
  
  6e2194abfba98c6723040b9d4e801a8d4e75cc8449d408638fa80edfa11865cad9d01b768c21919ed863f3e7f97d258930ccbbf6acbc0e65c730ead79f5c7141
- SSDEEP
  
  6144:iz+92mhAMJ/cPl3i+eLba0WZj+ufaZef6IMLWKH1cLb1UyOr0Sg3:iK2mhAMJ/cPlQIFXfaZefAyb1FOB2
Score

10^/10

plugx discovery trojan
- Detects PlugX payload
- PlugX
  PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
  trojan plugx
- Plugx family
  plugx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

plugxdiscoverytrojan

behavioral2

plugxdiscoverytrojan

© 2018-2025

Terms | Privacy