MalwareUsed by 1 actor

KillSomeOne

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Mustang Panda

Upon investigation, we found that the DOPLUGS malware uses the KillSomeOne module, a USB worm that was first disclosed by a Sophos reportnews article in November 2020.

via trend micro researchtrendmicro.com

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1587.001MalwareEvidence1

MITRE ATT&CK Tactic ID Name Resource Development T1587.001 Develop Capabilities: Malware

T1588.002ToolEvidence1

MITRE ATT&CK Tactic ID Name Resource Development T1588.002 Obtain Capabilities: Tool

Initial Access

1 technique

T1091Replication Through Removable MediaEvidence1

The KillSomeOne module is a plug-in specializing in malware distribution, information collection, and document theft via USB.

Execution

1 technique

T1053.005Scheduled TaskEvidence1

The following command line is executed to set up scheduled tasks to enable Wi-Fi connection: cmd.exe /c schtasks.exe /create /sc minute /mo 30 /tn "Security WIFI Script"

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

The following command line is executed to set up scheduled tasks to enable Wi-Fi connection: cmd.exe /c schtasks.exe /create /sc minute /mo 30 /tn "Security WIFI Script"

T1547.001Registry Run Keys / Startup FolderEvidence1

It sets up the value C:\Users\Public\HPSmartMZWx\HPSmart.exe xxx in the registry Software\Microsoft\Windows\CurrentVersion\Run key for persistence.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

The following command line is executed to set up scheduled tasks to enable Wi-Fi connection: cmd.exe /c schtasks.exe /create /sc minute /mo 30 /tn "Security WIFI Script"

T1547.001Registry Run Keys / Startup FolderEvidence1

It sets up the value C:\Users\Public\HPSmartMZWx\HPSmart.exe xxx in the registry Software\Microsoft\Windows\CurrentVersion\Run key for persistence.

Stealth

3 techniques

T1036.005Match Legitimate Resource Name or LocationEvidence1

The malicious Windows shortcut files (LNK) seen in Table 1 are as disguised as documents and archived in an RAR file.

T1140Deobfuscate/Decode Files or InformationEvidence1

It decrypts the encrypted payload by XOR with the single key, 0x73.

T1564.001Hidden Files and DirectoriesEvidence1

Before the worm behavior, these registries are enabled to hide the file extension and the folders that contain malware and stolen documents.

Discovery

5 techniques

T1012Query RegistryEvidence1

If the connection fails, the thread checks the value in registry (HKCU|HKLM)\System\CurrentControlSet\Control\Network\Version

T1016.001Internet Connection DiscoveryEvidence1

If the connection succeeds in connecting to https://www.microsoft.com/

T1049System Network Connections DiscoveryEvidence1

%comspec% /q /c netstat -ano >>"%~dp0AE353BBEB1C6603E_E.dat"

T1082System Information DiscoveryEvidence1

%comspec% /q /c systeminfo >"%~dp0AE353BBEB1C6603E_E.dat"

T1083File and Directory DiscoveryEvidence1

If the connection succeeds in connecting to https://www.microsoft.com/ , it will check the file extensions in these predefined folders

Lateral Movement

1 technique

T1091Replication Through Removable MediaEvidence1

The KillSomeOne module is a plug-in specializing in malware distribution, information collection, and document theft via USB.

Collection

2 techniques

T1005Data from Local SystemEvidence1

This functionality collects all files under the same folders and looks for the files with the following extensions: .doc .docx .ppt .pptx .xls .xlsx .pdf

T1025Data from Removable MediaEvidence1

The second behavior is related to USB infection. It applies the API DeviceIoControl with the parameter 0x2d1400 to identify the USB drive.

Command and Control

1 technique

T1573Encrypted ChannelEvidence1

Whether sending or receiving data to and from the C&C server, it will be encrypted or decrypted with the RC4 algorithm

INDICATORS OF COMPROMISE

IOCs tracked for this family

12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

7 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app2 years ago

hash.sha256●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

trend micro researchNews

Feb 20, 2024

Earth Preta Campaign Uses DOPLUGS to Target Asia | Trend Micro (US)

A PlugX-associated USB propagation module used for removable-media infection, malware distribution, victim information collection, and document theft. In this campaign it is integrated with a DOPLUGS variant to spread via USB and steal files/system data.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching12

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

KillSomeOne

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Mustang Panda

Upon investigation, we found that the DOPLUGS malware uses the KillSomeOne module, a USB worm that was first disclosed by a Sophos reportnews article in November 2020.

via trend micro researchtrendmicro.com

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1587.001MalwareEvidence1

MITRE ATT&CK Tactic ID Name Resource Development T1587.001 Develop Capabilities: Malware

T1588.002ToolEvidence1

MITRE ATT&CK Tactic ID Name Resource Development T1588.002 Obtain Capabilities: Tool

Initial Access

1 technique

T1091Replication Through Removable MediaEvidence1

The KillSomeOne module is a plug-in specializing in malware distribution, information collection, and document theft via USB.

Execution

1 technique

T1053.005Scheduled TaskEvidence1

The following command line is executed to set up scheduled tasks to enable Wi-Fi connection: cmd.exe /c schtasks.exe /create /sc minute /mo 30 /tn "Security WIFI Script"

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

The following command line is executed to set up scheduled tasks to enable Wi-Fi connection: cmd.exe /c schtasks.exe /create /sc minute /mo 30 /tn "Security WIFI Script"

T1547.001Registry Run Keys / Startup FolderEvidence1

It sets up the value C:\Users\Public\HPSmartMZWx\HPSmart.exe xxx in the registry Software\Microsoft\Windows\CurrentVersion\Run key for persistence.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

The following command line is executed to set up scheduled tasks to enable Wi-Fi connection: cmd.exe /c schtasks.exe /create /sc minute /mo 30 /tn "Security WIFI Script"

T1547.001Registry Run Keys / Startup FolderEvidence1

It sets up the value C:\Users\Public\HPSmartMZWx\HPSmart.exe xxx in the registry Software\Microsoft\Windows\CurrentVersion\Run key for persistence.

Stealth

3 techniques

T1036.005Match Legitimate Resource Name or LocationEvidence1

The malicious Windows shortcut files (LNK) seen in Table 1 are as disguised as documents and archived in an RAR file.

T1140Deobfuscate/Decode Files or InformationEvidence1

It decrypts the encrypted payload by XOR with the single key, 0x73.

T1564.001Hidden Files and DirectoriesEvidence1

Before the worm behavior, these registries are enabled to hide the file extension and the folders that contain malware and stolen documents.

Discovery

5 techniques

T1012Query RegistryEvidence1

If the connection fails, the thread checks the value in registry (HKCU|HKLM)\System\CurrentControlSet\Control\Network\Version

T1016.001Internet Connection DiscoveryEvidence1

If the connection succeeds in connecting to https://www.microsoft.com/

T1049System Network Connections DiscoveryEvidence1

%comspec% /q /c netstat -ano >>"%~dp0AE353BBEB1C6603E_E.dat"

T1082System Information DiscoveryEvidence1

%comspec% /q /c systeminfo >"%~dp0AE353BBEB1C6603E_E.dat"

T1083File and Directory DiscoveryEvidence1

If the connection succeeds in connecting to https://www.microsoft.com/ , it will check the file extensions in these predefined folders

Lateral Movement

1 technique

T1091Replication Through Removable MediaEvidence1

The KillSomeOne module is a plug-in specializing in malware distribution, information collection, and document theft via USB.

Collection

2 techniques

T1005Data from Local SystemEvidence1

This functionality collects all files under the same folders and looks for the files with the following extensions: .doc .docx .ppt .pptx .xls .xlsx .pdf

T1025Data from Removable MediaEvidence1

The second behavior is related to USB infection. It applies the API DeviceIoControl with the parameter 0x2d1400 to identify the USB drive.

Command and Control

1 technique

T1573Encrypted ChannelEvidence1

Whether sending or receiving data to and from the C&C server, it will be encrypted or decrypted with the RC4 algorithm

INDICATORS OF COMPROMISE

IOCs tracked for this family

12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

7 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app2 years ago

hash.sha256●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

trend micro researchNews

Feb 20, 2024

Earth Preta Campaign Uses DOPLUGS to Target Asia | Trend Micro (US)

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching12

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.