🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PlugX


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e
SHA3-384 hash: 8f18fb9eee4fdfbb26515aca06a097a66754a0143b6bc5fb1ee54106b083d3c86a3523064ec350c6f6b6391179899f4c
SHA1 hash: da24c13d479932796e992c1f42e979e637e476d0
MD5 hash: 27f49c4608311a736ef96673b2300531
humanhash: mike-oregon-eighteen-three
File name:93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e
Download: download sample
Signature PlugX
Create hunting rule
File size:208'947 bytes
First seen:2021-08-02 09:21:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep 3072:DQIURTXJ+MokVhHrSCT8u56E19MW1etykWtSGzB2P5/js9PtNCfEhaCtpe5k0gLu:Ds9ochO4r1fb+GlC5/21Nk8pOgq
Threatray 4 similar samples on MalwareBazaar
TLSH T12E1413A756E14CABF1535EB201AA43F7C77AE3063A1D4A47CF101FE62A61283C45D36B
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter JAMESWT_WT
Tags:exe Plugx

Intelligence

File Origin
# of uploads :
1
# of downloads :
426
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/175759/
Detection(s):
PUA.Win.Trojan.Casino-141
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Creating a process from a recently created file
Creating a file
Creating a window
DNS request
Connection attempt
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Malware family:
PlugX
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2c34a15a-9e50-4799-848b-2ac61989eb9d
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/825421
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 457831 Sample: Dnv6NaZlBy Startdate: 02/08/2021 Architecture: WINDOWS Score: 84 37 Multi AV Scanner detection for domain / URL 2->37 39 Antivirus detection for dropped file 2->39 41 Antivirus / Scanner detection for submitted sample 2->41 43 3 other signatures 2->43 8 Dnv6NaZlBy.exe 12 2->8         started        11 AAM Updates.exe 2->11         started        13 AAM Updates.exe 2->13         started        15 AAM Updates.exe 2->15         started        process3 file4 29 C:\Users\user\AppData\Local\Temp\hex.dll, PE32 8->29 dropped 31 C:\Users\user\AppData\Local\Temp\web.exe, PE32 8->31 dropped 17 rundll32.exe 1 8->17         started        process5 process6 19 web.exe 2 4 17->19         started        file7 25 C:\ProgramData\AAM UpdatesblF\hex.dll, PE32 19->25 dropped 27 C:\ProgramData\...\AAM Updates.exe, PE32 19->27 dropped 22 AAM Updates.exe 6 19->22         started        process8 dnsIp9 33 rainydaysweb.com 154.211.14.156, 443, 80 HKKFGL-AS-APHKKwaifongGroupLimitedHK Seychelles 22->33 35 192.168.2.1 unknown unknown 22->35
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e/
Threat name:
Win32.Backdoor.Plugx
Create hunting rule
Status:
Malicious
First seen:
2021-03-20 00:44:45 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
36 of 46 (78.26%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
80deed939a520696968335d1bb2a9fcce7053c0156f679ba261824d0a2d44967
PlugX
86df93f906086a656f1b5e26bfa134996206769968dca47442b1141e5e112816
PlugX
f631e8f0c723cccbc5b26387f4100351de2e158b6770e962733734be6ca119d5
PlugX
Result
Malware family:
plugx
Create hunting rule
Score:
  10/10
Tags:
family:plugx persistence trojan
Link:
https://tria.ge/reports/210802-ngpw47w9hj/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
PlugX
Malware Config
C2 Extraction:
rainydaysweb.com:80
rainydaysweb.com:443
rainydaysweb.com:53
Unpacked files
SH256 hash:
f5d2954f5229e42e2e5765e798bf9c4b797b4fbe2e01e72f7e54d41f29828386
MD5 hash:
ef2cbc3b6d4a8ab2ab8196f6268c09a8
SHA1 hash:
f8c96218af7784d3ee3bd64ba7e58879107b6d0e
Detections:
win_plugx_auto
Create hunting rule
Link:
https://www.unpac.me/results/48f055d5-3dd4-42a3-a86a-64ceb61140b4/
SH256 hash:
78c73327e9af79216e8c619a1b48131651222d80017731d6c6a1328f99d7a26f
MD5 hash:
d5bc3f32de63cbc11122cbf53c3b126f
SHA1 hash:
1d9c3e59128c5646dc5bca3b5d85896cfb3afc43
Link:
https://www.unpac.me/results/48f055d5-3dd4-42a3-a86a-64ceb61140b4/
SH256 hash:
d7463ee7fe17c1ab8bcfdbf5f0f2bc92d384b6d0ec61a1308b55a53c9964bf79
MD5 hash:
9857c65b8e28f0c23da43ee90be9de01
SHA1 hash:
100ea71a5448097aa35567319b58842c61a8836d
Link:
https://www.unpac.me/results/48f055d5-3dd4-42a3-a86a-64ceb61140b4/
SH256 hash:
93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e
MD5 hash:
27f49c4608311a736ef96673b2300531
SHA1 hash:
da24c13d479932796e992c1f42e979e637e476d0
Link:
https://www.unpac.me/results/48f055d5-3dd4-42a3-a86a-64ceb61140b4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_plugx_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.plugx.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/175759/

Comments