🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PlugX


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91
SHA3-384 hash: 1ca769576a29c31715aeb447dd2ab9a2738b51e43dfa4e67dce090b470e2da49d1a05f84df2108533246fb48f11c6129
SHA1 hash: 020b0f179386a5ceee09e042ed7818ee42b2eba8
MD5 hash: 23595373d96bdbaf4a1361971aa96539
humanhash: pluto-solar-friend-apart
File name:a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91
Download: download sample
Signature PlugX
Create hunting rule
File size:509'095 bytes
First seen:2021-08-02 09:22:22 UTC
Last seen:2021-08-02 09:32:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla)
ssdeep 12288:NsOW6Q4OWz9hVT+t0EzyHkxrmcHmkw7IKn6ToOcS5VXE:fW6VXRhfEzyElHmkw7L6ToOw
Threatray 743 similar samples on MalwareBazaar
TLSH T179B4F102FAC185F2D63219360929AB25747C7D301E25CE6BB3D86E6DD9350C1A235FB7
dhash icon 9494b494d4aeaeac (922 x DCRat, 486 x NirCmd, 172 x RedLineStealer)
Reporter JAMESWT_WT
Tags:exe Plugx

Intelligence

File Origin
# of uploads :
2
# of downloads :
472
Origin country :
n/a
Vendor Threat Intelligence
Detection:
plugx
Create hunting rule
Link:
https://www.capesandbox.com/analysis/175762/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a file
Deleting a recently created file
Enabling the 'hidden' option for recently created files
Creating a process with a hidden window
Replacing files
Launching a process
DNS request
Sending a UDP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Malware family:
Dllhijack
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/06392326-331e-41f4-854e-086a6dc00133
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/825418
Signature
Allocates memory in foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 457827 Sample: RjqGxcMlgV Startdate: 02/08/2021 Architecture: WINDOWS Score: 76 48 news.tibetsl.com 2->48 68 Malicious sample detected (through community Yara rule) 2->68 70 Multi AV Scanner detection for submitted file 2->70 72 Sigma detected: Suspicious Svchost Process 2->72 10 RjqGxcMlgV.exe 14 2->10         started        13 mcinsupd.exe 2 2->13         started        16 mcinsupd.exe 2 2->16         started        signatures3 74 System process connects to network (likely due to code injection or exploit) 48->74 process4 file5 44 C:\Users\user\AppData\Local\...\mytilus3.dll, PE32 10->44 dropped 46 C:\Users\user\AppData\Local\...\mcinsupd.exe, PE32 10->46 dropped 18 mcinsupd.exe 1 8 10->18         started        90 Writes to foreign memory regions 13->90 92 Allocates memory in foreign processes 13->92 21 svchost.exe 6 13->21         started        25 svchost.exe 6 16->25         started        signatures6 process7 dnsIp8 40 C:\Users\user\...\mcinsupd.exe, PE32 18->40 dropped 42 C:\Users\user\...\mytilus3.dll, PE32 18->42 dropped 27 mcinsupd.exe 2 18->27         started        56 save.tibetsl.com 21->56 58 info.tibetsl.com 21->58 60 help.tibetsl.com 21->60 82 Writes to foreign memory regions 21->82 84 Allocates memory in foreign processes 21->84 30 rundll32.exe 21->30         started        62 save.tibetsl.com 25->62 64 info.tibetsl.com 25->64 66 help.tibetsl.com 25->66 32 rundll32.exe 25->32         started        file9 signatures10 process11 signatures12 86 Writes to foreign memory regions 27->86 88 Allocates memory in foreign processes 27->88 34 svchost.exe 1 6 27->34         started        process13 dnsIp14 50 news.tibetsl.com 34->50 52 info.tibetsl.com 34->52 54 3 other IPs or domains 34->54 76 System process connects to network (likely due to code injection or exploit) 34->76 78 Writes to foreign memory regions 34->78 80 Allocates memory in foreign processes 34->80 38 rundll32.exe 34->38         started        signatures15 process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91/
Threat name:
Win32.Trojan.Waldek
Create hunting rule
Status:
Malicious
First seen:
2018-10-15 10:29:53 UTC
File Type:
PE (Exe)
Extracted files:
21
AV detection:
26 of 46 (56.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vfirzwvjn3kz3zz2pj6h3q3v3yqex3t2sui4l3trx4ataebsjkiq._file
Verdict:
malicious
Similar samples:
13979361d20b6c7184a7d3a8e5454782162a4ab734d2f9a01ed8421aeea5eee9
PlugX
1aca49752cef2bb58d097e0ac96963e32f14e4e6b1e6e24e11125d1e9ef54cf2
PlugX
4e41b23135ccd630532e143f5b6d41ae6d050b284fceaef1ef959e2414cf7c9a
PlugX
6ec6d3425cc3bdc664f5938119469a2947ad061dac33fafbd303998c9311a254
PlugX
70d86fc8d1247dcd26ed0927411614973d45216d676978f768e14cb16d362536
PlugX
80deed939a520696968335d1bb2a9fcce7053c0156f679ba261824d0a2d44967
PlugX
b5c7fbd5e805b6f1a9796c041be4f9829d2157e5b59a6608871511d045b8d79c
PlugX
b5e39716f576e5ff21e945560a98ee7ca7309491b2b7f2643728cd341b9c19de
PlugX
c7962bac550ffe20ff69bbcecea355ea9689fa1e76506d3d8343f1b1f5619706
PlugX
+ 733 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/210802-dz94clans6/
Behaviour
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
2631c277db6ddd2646edf6a37be66ebbd7d4da077d47397e5b18edc2fc6161dd
MD5 hash:
ff4818948ed46b248702086e324f0515
SHA1 hash:
116c0f019f9e7f44bb37d32f612204257150b9c2
Link:
https://www.unpac.me/results/ddbbe0ef-3ce0-4161-8a8f-b4c023dc5cf6/
SH256 hash:
9de88df6c05a547f80a571f4399d728b8d0997713eb791e829dfcda50aa66e4e
MD5 hash:
84ee6eddb4dffb10e32a69b2f6f14d12
SHA1 hash:
5a8606a21ceb960ee39ecd58480f250c3efe86e2
Link:
https://www.unpac.me/results/ddbbe0ef-3ce0-4161-8a8f-b4c023dc5cf6/
SH256 hash:
88bbb9b0de049704ecb2ff0404b48e334c391a088aa134d7ae2428e8906c0172
MD5 hash:
f94b379ee6adabdc0c3603011c128cc0
SHA1 hash:
184cb2d93d8991a6ef5f3a4d12778b2c6dabc1e6
Link:
https://www.unpac.me/results/ddbbe0ef-3ce0-4161-8a8f-b4c023dc5cf6/
SH256 hash:
a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91
MD5 hash:
23595373d96bdbaf4a1361971aa96539
SHA1 hash:
020b0f179386a5ceee09e042ed7818ee42b2eba8
Link:
https://www.unpac.me/results/ddbbe0ef-3ce0-4161-8a8f-b4c023dc5cf6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/175762/

Comments