MITRE ATT&CKsoftware (malware)
S0013 PlugX
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- Thoper, TVT, DestroyRAT, Sogu, Kaba, Korplug
- Version
- 3.3
- Created
- 2017-05-31
Description
PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.
Related
Uses · MITRE ATT&CK (49)
- T1686 Disable or Modify System Firewall technique
- T1680 Local Storage Discovery technique
- T1480.002 Mutual Exclusion sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1027.007 Dynamic API Resolution sub-technique
- T1070.009 Clear Persistence sub-technique
- T1622 Debugger Evasion technique
- T1620 Reflective Code Loading technique
- T1614 System Location Discovery technique
- T1127.001 MSBuild sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1071.004 DNS sub-technique
- T1102.001 Dead Drop Resolver sub-technique
- T1571 Non-Standard Port technique
- T1074.001 Local Data Staging sub-technique
- T1564.003 Hidden Window sub-technique
- T1574.001 DLL sub-technique
- T1204.002 Malicious File sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1497.001 System Checks sub-technique
- T1564.001 Hidden Files and Directories sub-technique
- T1056.001 Keylogging sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1027.001 Binary Padding sub-technique
- T1070.004 File Deletion sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1543.003 Windows Service sub-technique
- T1053.005 Scheduled Task sub-technique
Referenced by MITRE ATT&CK · uses (16)
- G1047 Velvet Ant group
- C0047 RedDelta Modified PlugX Infection Chain Operations campaign
- G1034 Daggerfly group
- G1021 Cinnamon Tempest group
- G1014 LuminousMoth group
- G0129 Mustang Panda group
- G0126 Higaisa group
- G0096 APT41 group
- G0093 GALLIUM group
- G0062 TA459 group
- G0001 Axiom group
- G0017 DragonOK group
- G0022 APT3 group
- G0027 Threat Group-3390 group
- G0044 Winnti Group group
- G0045 menuPass group
References
- http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf CIRCL PlugX March 2013
- https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage Dell TG-3390
- http://researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/ New DragonOK
- https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf Novetta-Axiom
- https://www.fireeye.com/blog/threat-research/2014/06/clandestine-fox-part-deux.html FireEye Clandestine Fox Part 2
- https://lastline3.rssing.com/chan-29044929/all_p1.html#c29044929a2 Lastline PlugX Analysis