PlugX

Malware & Tools · PlugX

· MalwareS0013 · Zararlı Yazılım

Type

malware

Techniques

Used By

15 groups

Platforms

Windows

Description

PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Citation: Lastline PlugX Analysis)(Citation: FireEye Clandestine Fox Part 2)(Citation: New DragonOK)(Citation: Dell TG-3390)

Tactic Coverage

stealth (17)discovery (14)command and control (7)execution (6)persistence (4)privilege escalation (3)collection (3)defense impairment (2)exfiltration (1)credential access (1)lateral movement (1)initial access (1)

Used By (15 groups)

G0022APT3Gothic Panda, Pirpi G0096APT41Wicked Panda, Brass Typhoon G0001AxiomGroup 72 G1021Cinnamon TempestDEV-0401, Emperor Dragonfly G1034DaggerflyEvasive Panda, BRONZE HIGHLAND G0017DragonOK G0093GALLIUMGranite Typhoon

Techniques (49)

T1012Query Registry

discovery

T1016System Network Configuration Discovery

discovery

T1027Obfuscated Files or Information

stealth

T1027.001Binary Padding

stealth

T1027.007Dynamic API Resolution

stealth

T1027.013Encrypted/Encoded File

stealth

T1033System Owner/User Discovery

References

https://attack.mitre.org/software/S0013 http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage http://researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf https://www.fireeye.com/blog/threat-research/2014/06/clandestine-fox-part-deux.html https://lastline3.rssing.com/chan-29044929/all_p1.html#c29044929a2

T1036.004Masquerade Task or Service

stealth

T1036.005Match Legitimate Resource Name or Location

stealth

T1041Exfiltration Over C2 Channel

exfiltration

T1049System Network Connections Discovery

discovery

T1053.005Scheduled Task

executionpersistence

T1056.001Keylogging

collectioncredential access

T1057Process Discovery

discovery

T1059.003Windows Command Shell

execution

T1070.004File Deletion

stealth

T1070.009Clear Persistence

stealth

T1071.001Web Protocols

command and control

T1071.004DNS

command and control

T1074.001Local Data Staging

collection

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1091Replication Through Removable Media

lateral movementinitial access

T1095Non-Application Layer Protocol

command and control

T1102.001Dead Drop Resolver

command and control

T1105Ingress Tool Transfer

command and control

T1106Native API

execution

T1112Modify Registry

defense impairmentpersistence

T1113Screen Capture

collection

T1120Peripheral Device Discovery

discovery

T1124System Time Discovery

discovery

T1127.001MSBuild

stealthexecution

T1135Network Share Discovery

discovery

T1140Deobfuscate/Decode Files or Information

stealth

T1204.002Malicious File

execution

T1480.002Mutual Exclusion

stealth

T1497.001System Checks

stealthdiscovery

T1543.003Windows Service

persistenceprivilege escalation

T1547.001Registry Run Keys / Startup Folder

persistenceprivilege escalation

T1564.001Hidden Files and Directories

stealth

T1564.003Hidden Window

stealth

T1571Non-Standard Port

command and control

T1573.001Symmetric Cryptography

command and control

T1574.001DLL

stealthexecution

T1614System Location Discovery

discovery

T1620Reflective Code Loading

stealth

T1622Debugger Evasion

stealthdiscovery

T1680Local Storage Discovery

discovery

T1686Disable or Modify System Firewall

defense impairment