Black friday Up to 3 extra licenses FOR FREE + Special offer for TI LOOKUP Get it now

PlugX

96
Global rank
99 infographic chevron month
Month rank
118 infographic chevron week
Week rank
0
IOCs

PlugX is a remote access trojan that is used extensively by Chinese APTs. The malware is primarily employed for spying on victims and can perform a variety of malicious activities, such as logging users’ keystrokes and exfiltrating information from browsers.

Backdoor
Type
China
Origin
16 January, 2008
First seen
20 January, 2025
Last seen
Also known as
Destroy RAT
Kaba
Korplug
Sogu
TIGERPLUG
RedDelta

How to analyze PlugX with ANY.RUN

Type
China
Origin
16 January, 2008
First seen
20 January, 2025
Last seen

IOCs

Domains
50.2.160.163
URLs
http://185.239.226.65/update
http://www.apple-net.com:8080/AC8C222429A87DC4/FC654631
http://www.wbemsystem.com/D4758EE59CE5D42A/E71770C2
http://www.destroy2013.com:443/b55b412f
http://www.destroy2013.com:443/a9349fd1
http://www.destroy2013.com:443/34ef8933
http://www.destroy2013.com/a51250b0
http://www.destroy2013.com/41cf3b8b
http://www.destroy2013.com/87f793ad
http://185.239.226.61:8080/update
http://infosecvn.com:443/update
http://45.142.166.112:443/c5b37b2e
http://45.142.166.112/41426740
http://45.142.166.112/1e98c71e
http://45.142.166.112/9b151346
http://45.142.166.112:443/768bd560
http://45.142.166.112:443/c4b8a314
http://45.142.166.112:443/4227ad5a
http://vietnam.zing.photos:443/update
http://vietnam.zing.photos/update
Last Seen at

Recent blog posts

post image
How to Prevent a Ransomware Attack on a Busin...
watchers 925
comments 0
post image
How Threat Intelligence Lookup Helps Enterpri...
watchers 982
comments 0
post image
InvisibleFerret Malware: Technical Analysis
watchers 6769
comments 0

What is PlugX malware?

PlugX is a remote access trojan (RAT) family used to gain access to and control computers. It has been around since 2008 and continues to be exploited today by advanced persistent threat (APT) groups, including Mustang Panda.

The malware is often employed for spying on victims, as it possesses a considerable set of tools that make it a go-to-option for attackers. Among other things, it can be utilized to log users’ keystrokes and exfiltrate sensitive information. As a result, PlugX has been involved in numerous attacks on organizations, primarily in Asia. However, there are also instances of attacks on private companies.

Use ANY.RUN free for 14 days

Try the full power of interactive analysis

Start your free trial

Technical details of the PlugX malicious software

Due to the fact that PlugX has been around for over a decade, the malware has undergone numerous iterations, and multiple variants have been created as a result. However, in most cases, they share similar functionality, which includes:

  • Collecting details about the operating system, hardware components, installed applications, and network settings.
  • Exfiltrating usernames, login credentials, personal information, and browsing history.
  • Recording every keystroke made on the infected system.
  • Managing processes, allowing the attackers to manipulate the system, including by turning off antivirus software.
  • Modifying registry entries, facilitating persistence on the computer.
  • Recording the screen of a compromised device.

PlugX has been known to leverage DLL side-loading to execute its malicious payload. DLL side-loading is a technique employed by malware to evade detection by traditional security measures. It involves injecting malicious code into a legitimate DLL (Dynamic Link Library) file, which is then executed by a trusted application.

Another persistence mechanism used by PlugX is the modification of the Windows Registry to kickstart its execution during every system booting.

Similar to njRAT and LimeRAT, PlugX makes use of USB-based propagation. It enables the malware to spread to other systems via infected USB devices.

Execution process of PlugX

We observe the entire execution chain of PlugX in ANY.RUN by submitting its sample for analysis.

PlugX is known for utilizing system applications and legitimate files in its attempts to evade defense mechanisms. In our example, the malware drops a legitimate ESET EHttpSrv.exe file (renamed as esetservice.exe) that is exploited to load the http_dll.dll. This DLL file has the capability to collect files from the infected system.

Expose malicious activities and get IOCs with ANY.RUN sandbox

  • Analyze malware in Windows 7, 10, and 11 VMs
  • Interact with files and links, just like on your own computer
  • Work in a private team space with your colleagues
Request 14-day free trial

The Remote Access Trojan (RAT) also exploits the dllhost process and runs an esetservice process as a service. Following privilege escalation, PlugX injects run once, establishing a connection to a Command and Control (C2) server and awaiting commands for subsequent malicious activities.

PlugX process graph in ANY.RUN PlugX`s process graph demonstrated in ANY.RUN

Distribution methods of the PlugX malware

Apart from USB-based distribution, PlugX is most often spread via phishing emails. Attackers usually place the malware inside an archive which is sent to victims in the form of an attachment. Once they open and launch the files inside the archive, the execution process begins.

Conclusion

PlugX is one of the most persistent threats in the world that has been actively used since 2008. Despite its long history, it regularly evolves, gaining new capabilities and features that allow it to beat defense systems. To make sure your organization remains safe from a PlugX infection, it is vital to keep up with the latest samples of the malware and its behavior. To this end, you can use ANY.RUN.

ANY.RUN is a cloud-based malware analysis sandbox that lets you investigate any threat to unveil its TTPs and collect IOCs. Thanks to its advanced interactivity, ANY.RUN makes it possible to conduct malware analysis by engaging with the malware and the infected system just like on a standard computer.

Try ANY.RUN for free – request a demo!

HAVE A LOOK AT

MetaStealer screenshot
MetaStealer
metastealer
MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations.
Read More
SSLoad screenshot
SSLoad
ssload
SSLoad is a malicious loader or downloader that is used to infiltrate target systems through phishing emails, perform reconnaissance and transmit it back to its operators delivering malicious payloads. To avoid detection, SSLoad employs various encryption methods and delivery techniques highlighting its versatile nature and complexity. It is believed to be a part of Malware-as-a-Service (MaaS) operation given its diverse delivery methods and implemented techniques.
Read More
Virlock screenshot
Virlock
virlock
Virlock is a unique ransomware strain that combines encryption capabilities with file infection techniques. First observed in 2014, it stands out due to its polymorphic nature and ability to embed its code into compromised files, ensuring continued propagation. Once it infects a system, it encrypts files and locks the screen, demanding a ransom for file recovery and system access.
Read More
WhiteSnake screenshot
WhiteSnake
whitesnake
WhiteSnake is a stealer with advanced remote access capabilities. The attackers using this malicious software can control infected computers and carry out different malicious activities, including stealing sensitive files and data, recording audio, and logging keystrokes. WhiteSnake is sold on underground forums and often spreads through phishing emails.
Read More
Bluesky Ransomware screenshot
BlueSky ransomware, first identified in June 2022, shares code similarities with other well-known ransomware families like Conti and Babuk. It primarily spreads via phishing emails and malicious links and can propagate through networks using SMB protocols. BlueSky uses advanced evasion techniques, such as hiding its processes from debuggers via the NtSetInformationThread API, making it difficult for analysts to detect and mitigate its attacks.
Read More
Bumblebee Loader screenshot
Bumblebee Loader
bumblebee
Bumblebee is a highly adaptable malware loader, often used by threat actors linked to the Conti and TrickBot cybercrime groups. Since its discovery in 2021, Bumblebee has been leveraged in phishing campaigns and email thread hijacking, primarily to distribute payloads like Cobalt Strike and ransomware. The malware employs obfuscation techniques, such as DLL injection and virtual environment detection, to avoid detection and sandbox analysis. Its command-and-control infrastructure and anti-analysis features allow it to persist on infected devices, where it enables further payload downloads and system compromise.
Read More