plugx | 1179d1e005587279ac26c271773f7b35914c759518fa7a7f9c4646a02e644dbc

General

Target
adb.zip
Size 1.7MB
Sample260919-s8elrssgke
SHA256 1179d1e005587279ac26c271773f7b35914c759518fa7a7f9c4646a02e644dbc
MD5 5141749a8b6ace439d467d06f0dc1da3
SHA1 c654fa5516bfe76e8f46a255ef165c62a85eb712
SHA512 1bea6ca5d7cdb28a5d4c96a88a70b7c5c895dd02102342ba2d6cfdd7b82e61f2784dd07ff786c51f5d928af0bf0977b3e03484f377a4e991d20afa2dcf519280
SSDEEP 49152:AleZAZNK+hrLhAdiSYs+u4vB2bhEOZt7MGhPsh+:AllZN/h/Dsp4p2bhxZOYK+
TLSH
T15685330EB1EEDC44A01C69119486CD2FE241357D2AF70FE9F45A3E1B2E035E532B9AB5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  adb/AdbWinApi.dll
- Size 41KB
- SHA256 35311bb7becba40d1fd99414cc1d14db837630e3ea13804442698b777476fe76
- MD5 2e4dce8fec941a97d41dafd9654a3ec5
- SHA1 ac8137b5e2bfc870115d60a476a829c144af359c
- SHA512 9d6415125e2a9e4cb24ee8b0bbf19563005dfe6fbd91e3f4bf0e2bd53d69257e67264483df487352751eb094a200fa92c1254a5ab33e706f7395b1077c92204c
- SSDEEP 768:MFQyPghaQeITkhhWBmnTED5bLyR6ENAMxl2:M9SeIIhlPBxl
- TLSH
  T169135C1276919877E16B193524F896324D7B3D426AF040CB3BA902BA5FB17C0EA7C367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  adb/UAC.TMP
- Size 47KB
- SHA256 b3d819160421011c002e1c4bd2621b15566134937e700697258eba954de5836b
- MD5 f4da06097e704faf47daa63ccf073793
- SHA1 e7ce70b70947b99436ad6c0f9b573f090da8bb1d
- SHA512 c363175ffc61aa3a659be663d1b7a53678cfe24b4318568024648e721fe9bb25c2742d18b539ea6c4fd60d65e9a567b2226dc6e3cf5656016df1d0a5f7b8e214
- SSDEEP 768:H7VX11fhqL6cnbf1b/kIqjrBwoRn1A0Xm8zb0uhcsx3PkJmnjEDkmR12+:JLfhqO0LdMXrBwol+OTzwiJx3Phu2
- TLSH
  T13F2339527290C032E197293458A5D3326A3F7C326AF8848B7F9512F95FB07E0F639366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  adb/adb.exe
- Size 804KB
- SHA256 ef4c7f4c417c18cd3394dd81ccd94381af252e0af81b0ad89b7e6d81412f4706
- MD5 790fb1184a3ed8e475263daa54f98469
- SHA1 37a60f670a4f3c68a4872ec2e95c0be2bd130dae
- SHA512 66a2325c59a7fdacd049f43b528224682245c2705f10c50a907b6454d5755522b9d9d07046426d42db8c324ba95adbde1de087e31a0fb21b635c1dc4ca25a4f8
- SSDEEP 12288:CMLitTtq+E3vEtR1PcUjB2ZuTvD5lnT7SQ22v9dzW74hGO2fVpUGpZdT3Rr8tz:CP5mC1P1jB2kv1xf9M4cThr8tz
- TLSH
  T122056D13A411D8F7F83201F21755EBB01662C6321153DCA276E9E82DAF72E52BE6933D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery plugx trojan
- Detects PlugX payload
- Family: PlugX
  PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
  trojan plugx
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
behavioral5 behavioral6

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects PlugX payload

Family: PlugX

Deletes itself

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6