Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
we discovered that the piece of customized PlugX malware is dissimilar to the general type news article of the PlugX malware that contains a completed backdoor command module, and that the former is only used for downloading the latter. Due to its different functionality, we decided to give this piece of customized PlugX malware a new name: DOPLUGS.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK Tactic ID Name Resource Development T1587.001 Develop Capabilities: Malware
MITRE ATT&CK Tactic ID Name Resource Development T1588.002 Obtain Capabilities: Tool
The KillSomeOne module is a plug-in specializing in malware distribution, information collection, and document theft via USB.
The malicious Windows shortcut files (LNK) seen in Table 1 are as disguised as documents and archived in an RAR file.
Deletes persistence: Deletes registry key (HKCU | HKLM) Software\Microsoft\Windows\CurrentVersion\Run Deletes itself by creating and executing a batch file del_OneNoteUpdate.bat in %temp%
32 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Customized PlugX variant used by Mustang Panda; delivered via ZIP attachment containing LNK that runs PowerShell to carve and unpack a TAR, then uses DLL search-order hijacking/sideloading (AOMEI Backupper executable) to load an encrypted PlugX payload.
A customized PlugX-derived downloader/backdoor used by Earth Preta. It supports a small command set including starting a CMD shell, adjusting network timeout/sleep settings, deleting persistence, and downloading the next-stage general PlugX payload (DLL/EXE/DAT) from C2.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.