plugx

General

Target
HPSmartclbl.zip
Size 3.2MB
Sample260123-wevyfacx7f
SHA256 d05255f0fa586e5eca2e7d5c15451843e20810139596dc5695a8deaa4c3d7882
MD5 70cafc597a942c2d71538f76dc22d884
SHA1 1802d7d5a6ce6ef275bdc3fd8d3644c3973e603b
SHA512 5a6f519d2d06f6baf98eb15acd2fb40bc7f7120604397ddffddabb2b07a5cc4639f689a81322c18ddd93ad3f7c0e65ad4dd659969dd8c2420d7e91665d6f482c
SSDEEP 98304:AhJuZ49y5Ac4DcqUO1HRaud+FrkkXAAfKLu+:Afv9a6cqUOhld7kXn+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  HPReport.exe
- Size 3.3MB
- SHA256 492df82529abe6cb8e927fb1513a4e250c293ec86d802a313515d944d6ea7018
- MD5 5ccecdd7a28ebb0401cc98e7fd89ba71
- SHA1 b5bafbe629650150c87f4b0fe0c7ddaf1eb7751e
- SHA512 0ebb40aadcd8da7bb5de423417026d01ac64dbe882737cf58a98807ca2105f0a8cb7547c9b8d8138d0a4cbd609e8fc0ce0988973d0e25b18d5eeeb168c730e74
- SSDEEP 98304:R/Fuk7b1n4vJfqvK+MiKibCh2VhFLOAkGkzdnEVomFHKnPtPv:RbbJKibCh2LFLOyomFHKnPtn
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  HPSmart.exe
- Size 1.9MB
- SHA256 b30239064a8ff5ede80b2a97508fb58ad8c39d6bbe27b3ce5d6dc9564dcf766b
- MD5 5475767bdb89f712cd6272797857af04
- SHA1 3508fc2ba5a3508f88cfcffdbb0808b498a04b03
- SHA512 316caf60955a3b7b3ac5beca07e48d941cb9ab27d8a697ae90e98a59e955adee686b415f38d1276cc181c68d80ead4f5d7bd239a37352cdf2d048866d96ed849
- SSDEEP 49152:cCqBiiacEvl6ooqyE+DGgW0fQi6WKsGMCrPqrKxRkfUzavFg9SirFDGIiCGgPLZj:mMiaXliqy3GgWyF6WKsGDrPq2LkLFtiP
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery execution plugx persistence trojan adware spyware
- Detects PlugX of Earth Preta campaign
- PlugX
  PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
  trojan plugx
- Plugx family
  plugx
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  InstanceFinderDlgUI.dll
- Size 754KB
- SHA256 4a0dfe9a33ce169986ffef8d40a44f2ae868b15976443b5b87756c8146d27478
- MD5 dd0a9a725528bbf363ee7ad0a4fabdea
- SHA1 150fd577f5017d590cfdeb93b2160d21816b59c4
- SHA512 fbf277a37fe8a214b4fde6ce5d9994f55f7c42cc59eb0f855ae540c6317163a7a729b8326ff2125a9241244658a3a4d853b8c4ea9cd315dacbd6ec67bf62ed09
- SSDEEP 12288:hvhS4iOAZRC3E+L6IR+KVDh4WKpUHg5XuuZKlEGq8H9WN/4r2fi7OBzDp:hZS4nAZRMUKJhEpSg5XlhGq8HQNQifio
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6