Extracted

• • Target
    avastsvc/AvastSvc.exe
  • Size 60KB
  • SHA256 85ca20eeec3400c68a62639a01928a5dab824d2eadf589e5cbfe5a2bc41d9654
  • MD5 a72036f635cecf0dcb1e9c6f49a8fa5b
  • SHA1 049813b955db1dd90952657ae2bd34250153563e
  • SHA512 e3582e0969361d272c2469ce139ec809b9b0ac98fbc5eb5bb287442aed4c6ba69ed8175b68970751c93730cfaf07b75c3bc5e4e24aeda8f984b24f33bb8e3da2
  • SSDEEP 768:Q/WQ3/TymxfsHYPry0bgYh3LKgMoCDGFh9D:Q+QvT7xUHYPDbgYVLWofD
  • TLSH
    T1545392129E001505D8AA0F30E0ADBA1E16237FFA1674825B3E39FC9DFE6D77B2850B54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryplugxpersistencetrojan

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx

  • Plugx family

    plugx

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    avastsvc/wsc.dll
  • Size 80KB
  • SHA256 e8f55d0f327fd1d5f26428b890ef7fe878e135d494acda24ef01c695a2e9136d
  • MD5 722b15bbc15845e4e265a1519c800c34
  • SHA1 56bac516227d9fddc08ca586dba5c9085d203f99
  • SHA512 a925614f3e89e37198d875670b3844449d6ab77728d53c1a06a5db035b7117a0b61cd8ada0022b6b5e0e8d6fad9417561a82cdbb5b288273c60b1469816a9d0d
  • SSDEEP 1536:HEI2BTzyutxs8TLWyEL59s6TaIret4R27t2Wfu63y:H+WTLHI4RQt2Wfri
  • TLSH
    T1E9837D6136D1C1B2C84E427A9555CB11637A3522CEFA4483BFEB4B8DAF912E0773F281
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4