Extracted

• • Target
    AAM UpdatesEqn/AAM Updates.exe
  • Size 185KB
  • SHA256 0459e62c5444896d5be404c559c834ba455fa5cae1689c70fc8c61bc15468681
  • MD5 c70d8dce46b4551133ecc58aed84bf0e
  • SHA1 00626346632fdfb2a1d5831793e92a3601ec4d9f
  • SHA512 12117c7fa9acef9a2a8d7da53a2a435dd45298bb98439025e2c4a3bb0c8096675d5541c0b2eb7246164e2a19cd879f98c0a007b0f73691d59036822be01a6f92
  • SSDEEP 3072:Ab6eqM+UdkAkko1tnC0Ag0Fuj8zDTBfhXxFGS7EArdUYVS77ylmrYM:o6VM+Uu5Lm0AO4DTB9GSYAfUUmrYM
  • TLSH
    T10A048D04B6E28573D471093144B9BEA44639F9392F12CF7BBF98361B2D653C09533ABA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryplugxpersistencetrojan

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx

  • Plugx family

    plugx

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    AAM UpdatesEqn/hex.dll
  • Size 20KB
  • SHA256 f331eb3d7f6789e48f2e3bfb1a87595561722f45aaec150df537488587024096
  • MD5 eafaba7898e149895b36ee488e3d579c
  • SHA1 64bfd0f7ecf21c8d961b6176863ecd5015bf4b64
  • SHA512 46413b264438622d717a3dc28b0620940f05a8322f8d2a00f7521aef978bb8e78d6e8c885339a3a28be52273f37c0cab11711143c8e687c0c2472ac8f2f3c355
  • SSDEEP 48:aDliH6TlonoLk9mBzGSwX56BCP/szcYijZc64u1MDLpXpUM6Et2MfQGEWzfD:ulI6xuowkzMX8B6/ODLpZUqVr7
  • TLSH
    T1B692847BD7D13A19C03C2BB5C98B3E53585B9C3923F8001AD253BA1619552E2EE26D83
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4