plugx | 8fd2ab26d5397dfcef9a48d4106eec604c8e38b86e2ccc148757a157c83f4f8c | Triage

Submit
Reports

Overview

overview

Static

static

3

8fd2ab26d5...8c.exe

windows7-x64

8fd2ab26d5...8c.exe

windows10-2004-x64

Sharing

General

Target

8fd2ab26d5397dfcef9a48d4106eec604c8e38b86e2ccc148757a157c83f4f8c
Size

568KB
Sample

250103-vdg5hstlgz
MD5

b60b6387fb18df16e563a5e1b374e080
SHA1

cf69fdb45dc3ab5958997cc411c664a6f49602c9
SHA256

8fd2ab26d5397dfcef9a48d4106eec604c8e38b86e2ccc148757a157c83f4f8c
SHA512

1463a88c6b93896666117c6c33124c23a9de5edb68fd60f65db97794b5e08fd6763cf4f5b929ee8dd0cc7f9a1d03e4be08dceeb95fa74ee62b99a6984658685c
SSDEEP

12288:XTKfDgWulALVZkES0RgGEVhkyA7F3Xl5MB8vTOvcX6C1dcDbpOZZo+NjrDhWg6jJ:OffuCXpo

Score

10^/10

plugx discovery trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

8fd2ab26d5397dfcef9a48d4106eec604c8e38b86e2ccc148757a157c83f4f8c.exe

Resource

win7-20241023-en

plugx discovery trojan

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

8fd2ab26d5397dfcef9a48d4106eec604c8e38b86e2ccc148757a157c83f4f8c.exe

Resource

win10v2004-20241007-en

plugx discovery trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  8fd2ab26d5397dfcef9a48d4106eec604c8e38b86e2ccc148757a157c83f4f8c
- Size
  
  568KB
- MD5
  
  b60b6387fb18df16e563a5e1b374e080
- SHA1
  
  cf69fdb45dc3ab5958997cc411c664a6f49602c9
- SHA256
  
  8fd2ab26d5397dfcef9a48d4106eec604c8e38b86e2ccc148757a157c83f4f8c
- SHA512
  
  1463a88c6b93896666117c6c33124c23a9de5edb68fd60f65db97794b5e08fd6763cf4f5b929ee8dd0cc7f9a1d03e4be08dceeb95fa74ee62b99a6984658685c
- SSDEEP
  
  12288:XTKfDgWulALVZkES0RgGEVhkyA7F3Xl5MB8vTOvcX6C1dcDbpOZZo+NjrDhWg6jJ:OffuCXpo
Score

10^/10

plugx discovery trojan
- Detects PlugX payload
- PlugX
  PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
  trojan plugx
- Plugx family
  plugx
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

plugxdiscoverytrojan

behavioral2

plugxdiscoverytrojan

© 2018-2025

Terms | Privacy