MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 6e6bfcbc22644d060670718dea2c5a7d860edc55cf8bd6100e277e53a8b0fc92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
PlugX
Vendor detections: 10
| SHA256 hash: | 6e6bfcbc22644d060670718dea2c5a7d860edc55cf8bd6100e277e53a8b0fc92 |
|---|---|
| SHA3-384 hash: | 663e4cd63c62c3507b28f14447c935f130dca77eab14606ff56b5e82864e2f53435c8ace33951d294ab9aef47087b075 |
| SHA1 hash: | cbc30251bb9392dc0c47b2b1084273c0aa58a0dc |
| MD5 hash: | b921f1f433015d3780e9c13ab245f2eb |
| humanhash: | fix-johnny-march-king |
| File name: | 6e6bfcbc22644d060670718dea2c5a7d860edc55cf8bd6100e277e53a8b0fc92 |
| Download: | download sample |
| Signature | PlugX |
| File size: | 273'638 bytes |
| First seen: | 2022-02-22 08:28:50 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 3c98c11017e670673be70ad841ea9c37 (5 x HawkEye, 5 x NanoCore, 4 x Plugx) |
| ssdeep | 6144:yz+92mhAMJ/cPl3ieBLVcFtRbUN5T+ZjOEGdjPHZ17jsjnvlmV8i:yK2mhAMJ/cPlfcFnU6kdZsnvYT |
| Threatray | 75 similar samples on MalwareBazaar |
| TLSH | T15744020777C555BBC71201302FAE3B8EE2B9A53964FDAA09FF91074D7A60453821BE63 |
| File icon (PE): |  |
| dhash icon | e4c89cdcccccc4e4 (3 x PlugX) |
| Reporter |  JAMESWT_WT |
| Tags: | exe KorPlug Plugx |
Intelligence
File Origin
# of uploads :
1
# of downloads :
268
Origin country :
n/a
Vendor Threat Intelligence
Detection:
PlugX
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a file in the Windows directory
Enabling the 'hidden' option for recently created files
Creating a service
Launching a service
Launching a process
Forced system process termination
Adding an access-denied ACE
Sending an HTTP POST request
Sending a custom TCP request
Enabling autorun for a service
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
greyware overlay packed shell32.dll update.exe
Verdict:
Malicious
Result
Threat name:
Codoso Ghost
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Deletes itself after installation
Drops executables to the windows directory (C:\Windows) and starts them
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Executable Used by PlugX in Uncommon Location
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Yara detected Codoso Ghost
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Ymacco
Status:
Malicious
First seen:
2021-12-27 13:36:00 UTC
File Type:
PE (Exe)
Extracted files:
49
AV detection:
23 of 28 (82.14%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 65 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
suricata
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Checks computer location settings
Deletes itself
Loads dropped DLL
Executes dropped EXE
suricata: ET MALWARE Gulpix/PlugX Client Request
suricata: ET MALWARE Possible PlugX Common Header Struct
Unpacked files
SH256 hash:
a14cd5036eaba06d053a0a2deb2ea70b9e390bed4cb1f23e0e661583debddd3f
MD5 hash:
9cd5500ceb60679b7323e86ad9db8c4e
SHA1 hash:
8d80699463da8611dbab7f3b1ee4e2cf0fb0a848
Detections:
win_plugx_w2
win_plugx_auto
SH256 hash:
dc8efac59a4a7f48f647eff38c6f33f28bf1923a856725561e192fd9f5ba1027
MD5 hash:
66c525de353c0040a86dbd01b2bc0d15
SHA1 hash:
14440fc91e7085928fa072d65b0937c604f7e2d2
SH256 hash:
7b0cd33eb5104853a26628e4af56c218afeae067672c10a1fef4d92f1c458baf
MD5 hash:
c37e6cdda2d8c6d6b2414434bec83002
SHA1 hash:
b008c7bb8fcd5a27ceaf7b7ae0f51ed17d08545e
SH256 hash:
6e6bfcbc22644d060670718dea2c5a7d860edc55cf8bd6100e277e53a8b0fc92
MD5 hash:
b921f1f433015d3780e9c13ab245f2eb
SHA1 hash:
cbc30251bb9392dc0c47b2b1084273c0aa58a0dc
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Korplug
Score:
0.90
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.