Fresh PlugX October 2019
On 15 November 2019, I received a VirusTotal notification for a copy of PlugX that had been uploaded ( Yara - PlugXBootLDRCode from https://github.com/citizenlab/malware-signatures/blob/master/malware-families/plugx.yara ).
|
MD5 : ce67994a4ee7cf90645e93aec084230d SHA1 : b42c84f851b8b7d2d2ddfbc9ac94e001204faf45 SHA256 : 6b46e36245b5b9ed13c0fbfae730b49c04aba43b98deb75e388e03695ff5cbd1 Type : Win32 DLL First seen : 2019-11-15 08:04:32 UTC Last seen : 2019-11-15 08:04:32 UTC  First name : plugx.dll |
What stood out from the notification (outside of the file being named plugx.dll) was a compilation time of Fri Oct 4 08:34:45 2019 UTC (a little more then a month before the writing of this post).
Initial Validation
This specific rule matches on operations for assembling a set of API calls - shown below| $ yara -s All.yara sample PlugXBootLDRCode [PlugX,Family] 6b46e36245b5b9ed13c0fbfae730b49c04aba43b98deb75e388e03695ff5cbd1 0x7708:$GetProcAdd: 80 38 47 75 36 80 78 01 65 75 30 80 78 02 74 75 2A 80 78 03 50 0x7786:$L4_LoadLibraryA: C7 85 5C FF FF FF 4C 6F 61 64 C7 85 60 FF FF FF 4C 69 62 0x7859:$L4_ExitThread: C7 85 FC FE FF FF 45 78 69 74 C7 85 00 FF FF FF 54 68 72 65 |
 |
| Screenshot of match condition in IDA |
From a quick comparison of the strings, a quick Google search found previous reporting confirming this file was PlugX (ref: http://takahiroharuyama.github.io/blog/2014/03/27/id-slash-idapython-scripts-extracting-plugx-configs/)
| DEMO... THIS IS A DEMO VERSION!!! \\.\PIPE\RUN_AS_USER(%d) %WINDIR%\SYSTEM32\SERVICES.EXE Software\Microsoft\Windows\CurrentVersion\Run System\CurrentControlSet\Services debug.hlp C:\Windows\System32\rundll32.exe "%s" BypassUAC %s PI[%8.8X] %s\%d.plg mytilus3.hlp %04d-%02d-%02d %02d:%02d:%02d |
Overlaps with versions
A outstanding point of reference evaluating PlugX is the Sophos report (https://www.sophos.com/en-us/medialibrary/pdfs/technical%20papers/plugx-thenextgeneration.pdf). On Page 7, Gabor Szappanos has a table covering the supported commands. In this copy, sub_10008DE acts as a command handler for evaluating operator commands and can be used to evaluate this copy against that from 2014:
In the above screenshot, many of the commands from the 2014 version are present; some additional commands are present, however, handled withing sub-functions of sub_10008DE.
What did appear unique was a set of commands for monitor clipboard activity:
An initial Google search did not show any hits for these being previously documented commands in PlugX - suggesting it may be a new feature - however, further analysis is needed to validate this.
Comments
Post a Comment