Eset PlugX Korplug Mustang Panda March 2022

PlugX can enumerate and query for information contained within the Windows Registry.

PlugX has captured victim IP address details of the targeted machine.

Mustang Panda has delivered initial payloads hidden using archives and encoding measures. Mustang Panda has also utilized opaque predicates in payloads to hinder analysis.

PlugX has utilized junk code and opaque predicates in payloads to hinder analysis.

Mustang Panda has leveraged obfuscated Windows API function calls that were concealed as unique names, or hashes of the Windows API.

PlugX has leveraged obfuscated Windows API function calls that were concealed as unique names, or hashes of the Windows API.

PlugX has leveraged XOR encryption with the key of 123456789.

Mustang Panda has used junk code within their DLL files to hinder analysis.

PlugX has the ability to gather the username from the victim’s machine.

PlugX has been disguised as legitimate Adobe and PotPlayer files. PlugX has also imitated legitimate software directories and file names through the creation and storage of a legitimate EXE and the malicious DLLs.

PlugX has created a scheduled task to execute additional malicious software, as well as maintain persistence.

PlugX allows actors to spawn a reverse shell on a victim.

Mustang Panda has deleted registry keys that store data and maintained persistence.

PlugX has the remove itself and other artifacts.

PlugX has deleted registry keys that store data and maintained persistence.

PlugX can be configured to use HTTP for command and control. PlugX has also used HTTPS for C2.

PlugX has collected system information including OS version, processor information, RAM size, location, host name, IP, and screen size of the infected host.

PlugX has a module to enumerate drives and find files recursively. PlugX has also checked the path from which it is running for specific parameters prior to execution.

PlugX can be configured to use raw TCP or UDP for command and control.

Mustang Panda has downloaded additional executables following the initial infection stage. Mustang Panda has also leveraged Visual Studio Code `code.exe` and Dev Tunnels using `DevTunnel.exe` to propagate additional tools and payloads.

PlugX can use the Windows API functions `GetProcAddress`, `LoadLibrary`, and `CreateProcess` to execute another process.

Mustang Panda has used various Windows API calls during execution and defense evasion.

PlugX has a module to create, delete, or modify Registry keys.

PlugX has identified system time through its GetSystemInfo command.

Mustang Panda has leveraged `LoadLibrary` to load DLLs.

PlugX has a module to enumerate network shares.

PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer. PlugX has also decrypted its payloads in memory.

Mustang Panda has sent malicious files requiring direct victim interaction to execute. Mustang Panda has also leveraged executable files that display decoy documents to the victim to provide a resemblance of legitimacy with customized themes related to the victim.

PlugX has leveraged a mutex in its infection process.

PlugX adds Run key entries in the Registry to establish persistence. PlugX has established persistence via the registry keys `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`.

Mustang Panda's PlugX variant has created a hidden folder on USB drives named RECYCLE.BIN to store malicious executables and collected data. Mustang Panda has also modified file attributes to `hidden` and `system`.

PlugX can modify the characteristics of folders to hide them from the compromised user. PlugX has also modified file attributes to hidden and system.

PlugX has the ability to execute a command on a hidden desktop.

Mustang Panda has encrypted C2 communications with RC4. Mustang Panda has also leveraged encryption and compression algorithms to obfuscate the traffic between the system and C2 server, methods observed included RC4, AES, XOR with 0x5a, and LZO.

PlugX can use RC4 encryption in C2 communications.

Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file. Mustang Panda has abused legitimate executables to side-load malicious DLLs.

PlugX has the ability to use DLL search order hijacking for installation on targeted systems. PlugX has also used DLL side-loading to evade anti-virus. PlugX has also used a legitimately signed executable to side-load a malicious payload within a DLL file.

Mustang Panda has developed custom malware for use in their operations.

PlugX has obtained the location of the victim device by leveraging `GetSystemDefaultLCID`.

PlugX has loaded its payload into memory.

Mustang Panda has delayed the execution of payloads leveraging ping echo requests `cmd /c ping 8.8.8.8 -n 70&&"%temp%\<legitimate executable>"`.

PlugX has collected a list of all mapped drives on the infected host.