PlugX

The attackers spoofed several sender email addresses to send spear phishing emails, most notably public addresses associated with the Sasakawa Peace Foundation and The White House.

Most of the attacks against academics involved webmail addresses using names of academics but are not tied to those academics openly online.

The actor copied the malware components into the directory, renamed a legitimate Sangfor executable to defender.exe for DLL sideloading, and established persistence through a scheduled task that launched the binary with SYSTEM privileges during system startup.

Functions – File/Registry operations – Keylogging, screenshot, remote shell

Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

Windows API functions are called directly | If this is not the case, the auto-run registry key is created instead.

Malware Delivery ◆Fake Applications/Documents ◆Disguise malware as fake application or documents | Fake Applications/Documents ◆Ofis_personeli_yolsuzluk_raporu.exe ◆Turkish, translate: Office staff corruption report ◆無法注冊網頁出現亂碼.exe

further analysis reveals that sub_10001590 acts as an obfuscated call to LoadLibraryA, which loads a specified Windows library into the address space of the calling process.

The actor copied the malware components into the directory, renamed a legitimate Sangfor executable to defender.exe for DLL sideloading, and established persistence through a scheduled task that launched the binary with SYSTEM privileges during system startup.

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

Upon execution, the malware will install itself as a service with the following parameters: Service Name RasTls... Service Description Symantec 802.1x Supplicant

ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.

The actor copied the malware components into the directory, renamed a legitimate Sangfor executable to defender.exe for DLL sideloading, and established persistence through a scheduled task that launched the binary with SYSTEM privileges during system startup.

create & inject code ... 1st injected process (e.g., svchost.exe) 2nd injected process (msiexec.exe) ... PlugX Payload (only resident in RAM)

Upon execution, the malware will install itself as a service with the following parameters: Service Name RasTls... Service Description Symantec 802.1x Supplicant

ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.

Type I: Bypassing UAC Dialog ... PlugX: create msiexec.exe process and inject code to it ... msiexec.exe: abuse DLL load order to execute malicious code in sysprep.exe process

Quarkslab said in a report shared with Cyber Security News (CSN) that rather than untangling flattened code paths and misleading calculations, it copied small routines into Python, executed code under emulation, or searched the workspace for useful clues.

the constant 0xffc97c1f —in combination with the string kernel32 , suggests that this sequence of function calls represents an API hashing routine , a mechanism often utilized by malware to obfuscate API calls from static analysis. | This mechanism works by traversing a series of API function names represented as strings, computing their hash values and subsequently comparing the computed hash values to a pre-computed constant during runtime. If a match is found, the corresponding API function is imported and executed.

The actor copied the malware components into the directory, renamed a legitimate Sangfor executable to defender.exe for DLL sideloading... before injecting into a process named synchost.exe.

create & inject code ... 1st injected process (e.g., svchost.exe) 2nd injected process (msiexec.exe) ... PlugX Payload (only resident in RAM)

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

The content repeatedly describes malware and threat actors creating hidden folders, adding dot prefixes to filenames, and setting file attributes such as hidden/system to conceal files and directories from users and defenders.

Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

further analysis reveals that sub_10001590 acts as an obfuscated call to LoadLibraryA, which loads a specified Windows library into the address space of the calling process.

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

More functions • e.g., network sniffing to steal proxy auth info

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

More functions • e.g., network sniffing to steal proxy auth info

Functions – File/Registry operations – Keylogging, screenshot, remote shell – portscan, SQL command, etc…

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

APT1 listed connected network shares. APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$. APT41 used the net share command as part of network reconnaissance.

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

BBSRAT uses Expand to decompress a CAB file into executable content.

Supported Protocols – TCP, HTTP, UDP, ICMP (not implemented) ... Type III ... TCP & HTTP supported | Supported Protocols – TCP, HTTP, UDP, ICMP (not implemented) ... Type II ... More protocols • ICMP • DNS [5] (not sure) ... Type III ... TCP & HTTP supported

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

По данным специалистов, в новых атаках HoneyMyte сначала устанавливала на машины жертв PlugX, а уже через него разворачивала CoolClient.

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

Additionally, the actors have now added the popular PlugX backdoor to their toolkit. An additional backdoor appears to be a new, custom-built tool... named 'FormerFirstRAT'.