File: 8a23c6f4ed334a04f6d5283bdca052ff79dbe1bec182b5cf5ef2f1f70ccb7a4e

Metadata
File name:plugx_00fdb6ad7345c0912ea9d2fa4c49950e
File type:PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive
File size:241622 bytes
Analysis date:2016-02-21 14:17:41
MD5:00fdb6ad7345c0912ea9d2fa4c49950e
SHA1:6f602871d42d262239b45a6f7fc9222fee17edf0
SHA256:8a23c6f4ed334a04f6d5283bdca052ff79dbe1bec182b5cf5ef2f1f70ccb7a4e
SHA512:c94e756b42eb30aea403040409d70ac033fb59697eddc478225043299ed74be6008e4aa5e2797f3b54c4caf13618a4c1f8bb23b62105bb377d2a07fdb26dda59
SSDEEP:6144:Fu2urzh9xu/XkauF5Jglj+uATyXAT6jClkao5WCrbCa:Futrzh9xOXkWhXANTgClkaUhT
IMPHASH:9402b48d966c911f0785b076b349b5ef
Authentihash:N/A
Related resources
APTNotes
Cyber threat intelligence reports associated with 8a23c6f4ed334a04f6d5283bdca052ff79dbe1bec182b5cf5ef2f1f70ccb7a4e.
Loading...
Domains
Domains the malware sample communicates with.
DomainIP
exchange.likescandy.com127.0.0.1
Hosts
Hosts the malware sample communicates with.
HTTP Requests
HTTP requests the malware sample makes.
AV Detections
AV detection names associated with the malware sample.
Mutants
Mutants created by the malware sample.
Registry keys
Registry keys created by the malware sample.
ALYacTrojan.Dropper.UMU
AVGDropper.Generic_c.NJC
AVwareTrojan.Win32.Generic!BT
Ad-AwareTrojan.Dropper.UMU
AgnitumTrojan.Korplug!77M4PEkjyg4
AhnLab-V3Dropper/Plugx.241622
Antiy-AVLTrojan[Backdoor]/Win32.Gulpix
ArcabitTrojan.Dropper.UMU
AvastVBS:Malware-gen
AviraTR/Agent.241622
Baidu-InternationalTrojan.Win32.Korplug.A
BitDefenderTrojan.Dropper.UMU
CAT-QuickHealBackdoor.Poison.rw5
ClamAVWin.Trojan.PlugX-100
ComodoUnclassifiedMalware
CyrenW32/Backdoor.HFOO-8697
DrWebBackDoor.HRB.8
ESET-NOD32Win32/Korplug.A
EmsisoftTrojan.Dropper.UMU (B)
F-ProtW32/Backdoor2.HNAA
F-SecureGen:Variant.Kazy.87280
FortinetW32/PLUGX.ME!tr
GDataTrojan.Dropper.UMU
IkarusTrojan.Win32.Genome
JiangminTrojan/Genome.cvrx
K7AntiVirusTrojan ( 00071a9a1 )
K7GWTrojan ( 00071a9a1 )
KasperskyBackdoor.Win32.Gulpix.a
KingsoftWin32.Troj.Genome.(kcloud)
MalwarebytesTrojan.Dropper
McAfeeGeneric.nb
McAfee-GW-EditionGeneric.nb
MicroWorld-eScanTrojan.Dropper.UMU
MicrosoftBackdoor:Win32/Plugx.C
NANO-AntivirusTrojan.Win32.Korplug.yagpn
PandaBck/Qbot.AO
Qihoo-360Malware.Radar01.Gen
RisingPE:Trojan.Win32.Generic.13159327!320181031
SophosTroj/PLUGX-C
SymantecBackdoor.Korplug
TencentWin32.Backdoor.Gulpix.Fsf
TheHackerTrojan/Chifrax.a
TotalDefenseWin32/Tnega.APZP
TrendMicroBKDR_PLUGX.GAN
TrendMicro-HouseCallBKDR_PLUGX.GAN
VBA32Backdoor.Gulpix
VIPRETrojan.Win32.Generic!BT
ViRobotTrojan.Win32.A.Genome.241622[h]
ZillyaTrojan.Genome.Win32.191352
ZonerTrojan.Korplug.A
nProtectTrojan/W32.Agent.241622
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\IMM
HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF
HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\SystemShared
HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004
HKEY_CURRENT_USER\Software\Microsoft\windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\Software\Microsoft\windows\CurrentVersion\Explorer\AutoComplete
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
HKEY_USERS\S-1-5-21-1547161642-507921405-839522115-1004_Classes
HKEY_LOCAL_MACHINE\Software\Classes
\REGISTRY\USER
HKEY_LOCAL_MACHINE\Software\Classes\CLSID
CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}
CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TreatAs
\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}
\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InprocServer32
\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InprocServerX86
\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\LocalServer32
\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InprocHandler32
\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InprocHandlerX86
\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\LocalServer
HKEY_CLASSES_ROOT\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}
HKEY_CLASSES_ROOT\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\TreatAs
CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}
CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TreatAs
\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}
\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InprocServer32
\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InprocServerX86
\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\LocalServer32
\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InprocHandler32
\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InprocHandlerX86
\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\LocalServer
HKEY_CLASSES_ROOT\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}
HKEY_CLASSES_ROOT\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TreatAs
CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}
CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TreatAs
\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}
\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InprocServer32
\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InprocServerX86
\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\LocalServer32
\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InprocHandler32
\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InprocHandlerX86
\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\LocalServer
HKEY_CLASSES_ROOT\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}
HKEY_CLASSES_ROOT\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TreatAs
HKEY_CLASSES_ROOT\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32
HKEY_CLASSES_ROOT\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32
HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}
CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TreatAs
\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}
\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32
\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServerX86
\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\LocalServer32
\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocHandler32
\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocHandlerX86
\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\LocalServer
HKEY_CLASSES_ROOT\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}
HKEY_CLASSES_ROOT\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TreatAs
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSclient
CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}
CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TreatAs
\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}
\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\InprocServer32
\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\InprocServerX86
\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LocalServer32
\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\InprocHandler32
\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\InprocHandlerX86
\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LocalServer
\AppID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName
ActiveComputerName
HKEY_CLASSES_ROOT\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}
HKEY_CLASSES_ROOT\Interface\{F309AD18-D86A-11D0-A075-00C04FB68820}\ProxyStubClsid32
CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}
CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TreatAs
\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}
\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocServer32
\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocServerX86
\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\LocalServer32
\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocHandler32
\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InprocHandlerX86
\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\LocalServer
HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}
HKEY_CLASSES_ROOT\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TreatAs
HKEY_CLASSES_ROOT\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}
HKEY_CLASSES_ROOT\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32
HKEY_CLASSES_ROOT\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}
HKEY_CLASSES_ROOT\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32
CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}
CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TreatAs
\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}
\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32
\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServerX86
\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LocalServer32
\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandler32
\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandlerX86
\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\LocalServer
HKEY_CLASSES_ROOT\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}
HKEY_CLASSES_ROOT\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TreatAs
CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}
CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TreatAs
\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}
\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\InprocServer32
\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\InprocServerX86
\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\LocalServer32
\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\InprocHandler32
\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\InprocHandlerX86
\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\LocalServer
HKEY_CLASSES_ROOT\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}
HKEY_CLASSES_ROOT\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TreatAs
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM
Comments
User comments about 8a23c6f4ed334a04f6d5283bdca052ff79dbe1bec182b5cf5ef2f1f70ccb7a4e.
NOTICE: We have updated our privacy terms and conditions in accordance to GDPR. By using our site, you acknowledge that you have read and understand our Privacy Policy. Your use of ThreatMiner’s Products and Services is subject to these policies and terms.