PlugX
PlugX is a remote access tool (RAT) that uses modular plugins. It has been used by multiple threat groups. [1] [2] [3] [4]
Associated Software Descriptions
Name | Description |
---|---|
DestroyRAT | |
Sogu | |
Kaba | |
Korplug |
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
PlugX can be configured to use HTTP for command and control.[4] |
.004 | Application Layer Protocol: DNS |
PlugX can be configured to use DNS for command and control.[4] |
||
Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
PlugX adds Run key entries in the Registry to establish persistence.[1][6][5] |
Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
PlugX allows actors to spawn a reverse shell on a victim.[4][5] |
Enterprise | T1543 | .003 | Create or Modify System Process: Windows Service |
PlugX can be added as a service to establish persistence. PlugX also has a module to change service configurations as well as start, control, and delete services.[5][1][6][7][8] |
Enterprise | T1140 | Deobfuscate/Decode Files or Information |
PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.[5] |
|
Enterprise | T1083 | File and Directory Discovery |
PlugX has a module to enumerate drives and find files recursively.[5] |
|
Enterprise | T1574 | .002 | Hijack Execution Flow: DLL Side-Loading |
PlugX has used DLL side-loading to evade anti-virus.[2][4][9][6][10] |
Enterprise | T1105 | Ingress Tool Transfer |
PlugX has a module to download and execute files on the compromised machine.[5] |
|
Enterprise | T1056 | .001 | Input Capture: Keylogging |
PlugX has a module for capturing keystrokes per process including window titles.[5] |
Enterprise | T1036 | .004 | Masquerading: Masquerade Task or Service |
In one instance, menuPass added PlugX as a service with a display name of "Corel Writing Tools Utility."[7] |
Enterprise | T1112 | Modify Registry |
PlugX has a module to create, delete, or modify Registry keys.[5] |
|
Enterprise | T1106 | Native API |
PlugX can use the Windows API function CreateProcess to execute another process.[1] |
|
Enterprise | T1135 | Network Share Discovery | ||
Enterprise | T1095 | Non-Application Layer Protocol |
PlugX can be configured to use raw TCP or UDP for command and control.[4] |
|
Enterprise | T1057 | Process Discovery |
PlugX has a module to list the processes running on a machine.[5] |
|
Enterprise | T1012 | Query Registry |
PlugX can enumerate and query for information contained within the Windows Registry.[1][5] |
|
Enterprise | T1113 | Screen Capture | ||
Enterprise | T1049 | System Network Connections Discovery |
PlugX has a module for enumerating TCP and UDP network connections and associated processes using the |
|
Enterprise | T1127 | .001 | Trusted Developer Utilities Proxy Execution: MSBuild |
A version of PlugX loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application control techniques.[10] |
Enterprise | T1497 | .001 | Virtualization/Sandbox Evasion: System Checks |
PlugX checks if VMware tools is running in the background by searching for any process named "vmtoolsd". [11] |
Enterprise | T1102 | .001 | Web Service: Dead Drop Resolver |
Groups That Use This Software
ID | Name | References |
---|---|---|
G0022 | APT3 | |
G0027 | Threat Group-3390 | |
G0017 | DragonOK | |
G0045 | menuPass | |
G0062 | TA459 | |
G0093 | Soft Cell | |
G0096 | APT41 |
References
- Vasilenko, R. (2013, December 17). An Analysis of PlugX Malware. Retrieved November 24, 2015.
- Scott, M.. (2014, June 10). Clandestine Fox, Part Deux. Retrieved January 14, 2016.
- Miller-Osborn, J., Grunzweig, J.. (2015, April). Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets. Retrieved November 4, 2015.
- Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.
- Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018.
- PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
- FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017.
- Huss, D., et al. (2017, February 2). Oops, they did it again: APT Targets Russia and Belarus with ZeroT and PlugX. Retrieved April 5, 2018.
- Stewart, A. (2014). DLL SIDE-LOADING: A Thorn in the Side of the Anti-Virus Industry. Retrieved November 12, 2014.
- Lancaster, T. and Idrizovic, E.. (2017, June 27). Paranoid PlugX. Retrieved July 13, 2017.
- Lancaster, T., Idrizovic, E. (2017, June 27). Paranoid PlugX. Retrieved April 19, 2019.
- Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.
- Pantazopoulos, N., Henry T. (2018, May 18). Emissary Panda – A potential new malicious tool. Retrieved June 25, 2018.
- United States District Court Southern District of New York (USDC SDNY) . (2018, December 17). United States of America v. Zhu Hua and Zhang Shilong. Retrieved April 17, 2019.
- Axel F. (2017, April 27). APT Targets Financial Analysts with CVE-2017-0199. Retrieved February 15, 2018.
- Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.
- Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.