Researchers Find PlugX Builder, Controller and Possible Victim Data on Exposed Server
Summary
Hunt researchers found an exposed server containing a PlugX builder and controller, Korplug samples, and files that may contain data from infected hosts. A VBA script downloaded PlugX files from a Nepalese government website.
Key points
- The exposed Czech-hosted server held an outdated PlugX builder and controller, alongside logs, encrypted files, and a directory with more than 50 possible host entries.
- The builder can configure C2 settings, proxies, persistence, process injection, keylogging, and screen recording; the controller supports remote commands, file transfers, and log access.
- A VBA script downloaded three PlugX files from a Nepalese government website, which the researchers believe had been compromised; Hunt shared its findings with Nepal CERT.
- Samples used the PlugX “trinity” workflow: a legitimate executable, a sideloaded DLL, and a payload. Researchers also found Korplug samples and offensive security tools.
- Additional Korplug files communicated with a VPS in India; the researchers cited Apache 1.3.27 on ports 80 and 443 as characteristic of PlugX activity.
- Hunt reported that the files remained accessible as of May 26 and urged defenders to monitor exposed directories and older malware.
Article Details
- Attack Vectors
- A VBA script disguised as a text file downloads three PlugX files from a Nepalese government website that the article says was compromised, then executes one of them.
- The PlugX execution chain uses a legitimate executable vulnerable to DLL sideloading, an accompanying DLL, and a payload.
- The builder supports configuring process injection, persistence through a selected registry location, and C2 communications over HTTP, TCP, UDP, ICMP, or DNS.
- Defensive Notes
- Monitor exposed directories and older malware samples, which the article reports can remain active threats.
- Investigate unexpected hosting of malware files on legitimate websites, including government websites.
- Review systems for PlugX/Korplug artifacts and behavior, including suspicious DLL sideloading and C2 activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 01f11f89c1ef84e60068e60a6d9dff2d2277341673a981ecbf864dcaf72e7f30 | SHA-256 listed for fscan.rar in the article's indicators. |
| SHA256 | 1c3954b25fe7d32b72c8c8d7d9b6a1a3b9ff4d175b55cbaade435e0c770d0595 | SHA-256 listed for 111.exe, identified in the article as following the PlugX execution workflow. |
| SHA256 | 285f9d4a3d5511e68ccc9ff14f209ac6cfdc0c3a51063d217190d5b8d49c2e47 | SHA-256 listed for lable.icon, identified as a modified version of Nmap and as a Korplug variant. |
| SHA256 | 3a5088295708d3304f06de0499b9243bfbd68d14878615c531f0e346f47b389d | SHA-256 listed for 1.jpg in the article's indicators. |
| SHA256 | 76d590c38387f6042ad39b20cd86ea5a0f2632889e4dd18d67d2a7a188d20890 | SHA-256 listed for lable.rar in the article's indicators. |
| SHA256 | a9cec009503d067f241b5eddaea4e42c38edcb0b57c1b46e946c5281b7f1ea21 | SHA-256 listed for rar.exe in the article's indicators. |
| SHA256 | b150773df7b525ce2b70822a06c06241f251eae96c9ee12fc97776d3826d36a7 | SHA-256 listed for x3avast.exe in the article's indicators. |
MITRE ATT&CK
T1055 · Process InjectionThe builder's injection option lets an operator select an application process to inject into; wmiplayer.exe is given as the default.T1574.002 · DLL Side-LoadingThe article describes a PlugX execution chain using a legitimate executable vulnerable to DLL sideloading alongside a DLL and payload.
Malware
Korplugscript, and discuss additional IP addresses identified as command and control infrastructure for Korplug samples on the server. Due to the sensitive nature of some of the server's files, we will obscure detailsPlugXAs part of our continuous threat research and monitoring of open directories, the Hunt Research Team discovered an exposed server hosted in the Czech Republic that contained an outdated PlugX builder and controller.
Tools
Evil-WinRMThe directory includes many well-known tools used in offensive security operations, such as Evil-WinRM, Proxifier, and FScan.fscanThe directory includes many well-known tools used in offensive security operations, such as Evil-WinRM, Proxifier, and FScan.NmapThe directory contains several files, including instructions.exe, update_original.exe, encrypt_v3.2.exe, and lable.icon, which appears to be a modified version of the well-known Nmap network scanning tool.ProxifierThe directory includes many well-known tools used in offensive security operations, such as Evil-WinRM, Proxifier, and FScan.SweetPotatoAdditionally, we find a file named sweetpotatos.exe, which corresponds to the open-source project SweetPotato, as well as multiple other EXE and TXT files.
Countries
Czech RepublicAs part of our continuous threat research and monitoring of open directories, the Hunt Research Team discovered an exposed server hosted in the Czech Republic that contained an outdated PlugX builder and controller.IndiaAll of these files are identified as variants of Korplug, beaconing to a Vultr Holdings VPS located in India. Similar to our initial findings, this VPS has many open ports, notably ports 80 and 443 running ApacheNepal*Hunt has shared the details of our findings with the Nepal Computer Emergency Response Team (CERT).