Procedure examples

PlugX can enumerate and query for information contained within the Windows Registry.

PlugX has captured victim IP address details of the targeted machine.

PlugX can use API hashing and modify the names of strings to evade detection.

PlugX has utilized junk code and opaque predicates in payloads to hinder analysis.

PlugX has leveraged obfuscated Windows API function calls that were concealed as unique names, or hashes of the Windows API.

PlugX has leveraged XOR encryption with the key of 123456789.

PlugX has the ability to gather the username from the victim’s machine.

In one instance, menuPass added PlugX as a service with a display name of "Corel Writing Tools Utility."

PlugX has been disguised as legitimate Adobe and PotPlayer files. PlugX has also imitated legitimate software directories and file names through the creation and storage of a legitimate EXE and the malicious DLLs.

PlugX has exfiltrated stolen data and files to its C2 server.

PlugX has a module for enumerating TCP and UDP network connections and associated processes using the netstat command.

PlugX has created a scheduled task to execute additional malicious software, as well as maintain persistence.

PlugX has a module for capturing keystrokes per process including window titles.

PlugX has a module to list the processes running on a machine.

PlugX allows actors to spawn a reverse shell on a victim.

PlugX has the remove itself and other artifacts.

PlugX has deleted registry keys that store data and maintained persistence.

PlugX can be configured to use HTTP for command and control. PlugX has also used HTTPS for C2.

PlugX can be configured to use DNS for command and control.

PlugX has collected and staged the victim’s computer files for exfiltration.

PlugX has collected system information including OS version, processor information, RAM size, location, host name, IP, and screen size of the infected host.

PlugX has a module to enumerate drives and find files recursively. PlugX has also checked the path from which it is running for specific parameters prior to execution.

PlugX has copied itself to infected removable drives for propagation to other victim devices.

PlugX can be configured to use raw TCP or UDP for command and control.

PlugX uses Pastebin to store C2 addresses.

PlugX has a module to download and execute files on the compromised machine.

PlugX can use the Windows API functions `GetProcAddress`, `LoadLibrary`, and `CreateProcess` to execute another process.

PlugX has a module to create, delete, or modify Registry keys.

PlugX allows the operator to capture screenshots.

PlugX can identify removable media attached to compromised hosts.

PlugX has identified system time through its GetSystemInfo command.

A version of PlugX loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application control techniques.

PlugX has a module to enumerate network shares.

PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer. PlugX has also decrypted its payloads in memory.

PlugX has leveraged an initial executable disguised as a legitimate document to trick the target into opening it.

PlugX has leveraged a mutex in its infection process.

PlugX checks if VMware tools is running in the background by searching for any process named "vmtoolsd".

PlugX can be added as a service to establish persistence. PlugX also has a module to change service configurations as well as start, control, and delete services.

PlugX adds Run key entries in the Registry to establish persistence. PlugX has established persistence via the registry keys `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`.

PlugX can modify the characteristics of folders to hide them from the compromised user. PlugX has also modified file attributes to hidden and system.

PlugX has the ability to execute a command on a hidden desktop.

PlugX has used random, high-number, non-standard ports to listen for subsequent actions and C2 activities.

PlugX can use RC4 encryption in C2 communications.

PlugX has the ability to use DLL search order hijacking for installation on targeted systems. PlugX has also used DLL side-loading to evade anti-virus. PlugX has also used a legitimately signed executable to side-load a malicious payload within a DLL file.

PlugX has obtained the location of the victim device by leveraging `GetSystemDefaultLCID`.

PlugX has loaded its payload into memory.

PlugX has made calls to Windows API `CheckRemoteDebuggerPresent` and exits if it detects a debugger.

PlugX has collected a list of all mapped drives on the infected host.

PlugX has modified local firewall rules on victim machines to enable a random, high-number listening port for subsequent access and C2 activity.