Full Report
In relation to the latest variant of the PlugX RAT executed by STATICPLUGIN analyzed by IIJ-SECT, LAB52 aims to complement this information with additional observed deployment activity and encryption characteristics in samples analyzed by this team. PlugX PlugX is a long-running Remote Access Trojan (RAT) that has been consistently linked to multiple China-aligned threat actors […]
Analysis Summary
# Tool/Technique: PlugX (variant executed by STATICPLUGIN)
## Overview
PlugX is a sophisticated, long-running Remote Access Trojan (RAT) modularly designed for cyber-espionage. It is primarily used by China-aligned threat actors to maintain persistence, exfiltrate data, and execute remote commands on targeted systems. This specific variant utilizes MSBuild as a LOLBIN and leverages DLL side-loading via legitimate security software (G DATA Antivirus) to evade detection.
## Technical Details
- **Type:** Malware family (RAT)
- **Platform:** Windows
- **Capabilities:** Persistence, DLL side-loading, encrypted payload injection, credential/data theft, C2 communication, decoy document display.
- **First Seen:** PlugX family identified circa 2008; this specific variant/campaign dated February 2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment]
- **[TA0002 - Execution]**
- [T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild]
- **[TA0005 - Defense Evasion]**
- [T1574.002 - Hijack Execution Flow: DLL Side-Loading]
- [T1027 - Obfuscated Files or Information]
- [T1140 - Deobfuscate/Decode Files or Information]
- **[TA0003 - Persistence]**
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
## Functionality
### Core Capabilities
- **DLL Side-Loading:** Uses a legitimate G DATA Antivirus executable (`Avk.exe`) to load a malicious DLL (`Avk.dll`).
- **Persistence:** Establishes a Registry Run key named "G DATA" to ensure execution upon system startup.
- **Data De-obfuscation:** Employs XOR encryption (keys 0x7F and 0x4F) and RC4 (key `fzsbnWTgLLq`) to decrypt external data files and C2 configurations.
- **C2 Communication:** Communicates over port 443 to attacker-controlled domains to receive instructions.
### Advanced Features
- **LOLBIN Utilization:** Uses `MSBuild.exe` to execute a `.csproj` script, which automates the downloading of the final malware components.
- **API Hashing:** Uses custom hashing (e.g., `0x13B8A163` for `GetModuleFileNameW`) to resolve Windows APIs at runtime, hindering static analysis.
- **Decoy Tactics:** Displays a legitimate-looking PDF "Meeting Invitation" to the user while the infection proceeds in the background.
## Indicators of Compromise
- **File Hashes (SHA256):**
- `8421e7995778faf1f2a902fb2c51d85ae39481f443b7b3186068d5c33c472d99` (Avk.dll)
- `29cd44aa2a51a200d82cca578d97dc13241bc906ea6a33b132c6ca567dc8f3ad` (Invitation_Letter.zip)
- `de8ddc2451fb1305d76ab20661725d11c77625aeeaa1447faf3fbf56706c87f1` (Invitation_Letter.csproj)
- `5f9af68db10b029453264cfc9b8eee4265549a2855bb79668ccfc571fb11f5fc` (Invitation_Letter.exe/MSBuild)
- **File Names:** `Avk.exe`, `Avk.dll`, `AVKTray.dat`, `Invitation_Letter_No.02_2026.csproj`
- **Registry Keys:** `HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` (Value: "G DATA")
- **Network Indicators:**
- `https[:]//onedow[.]gesecole[.]net/download`
- `https[:]//decoraat[.]net:443`
- **Behavioral Indicators:** Creation of temporary files in `%TEMP%/[a-b0-9]{8}` with extensions `.cs`, `.cmdline`, and `.out`.
## Associated Threat Actors
- **Mustang Panda (TA416)**
- **APT41 (Winnti Group)**
- **APT10 (Stone Panda)**
- **Deep Panda**
## Detection Methods
- **Signature-based:** Detection of known PlugX/Korplug DLL signatures and G DATA side-loading pairs.
- **Behavioral:** Monitoring `MSBuild.exe` for unusual network connections or the execution of `.csproj` files from suspicious locations.
- **YARA Rules:** Target the specific XOR decryption routine (key 0x4F/0x7F) and the RC4 key structure found in the `.rdata` section.
## Mitigation Strategies
- **Binary Whitelisting:** Restrict the execution of developer tools like `MSBuild.exe` to authorized users only.
- **DLL Search Order Hijacking Protection:** Enable "Safe DLL Search Mode" and monitor for unsigned DLLs being loaded by signed binaries.
- **Email Security:** Implement robust attachment filtering and link scanning to block spear-phishing attempts.
- **Endpoint Monitoring:** Monitor the Registry Run keys for unauthorized additions, specifically targeting `%Users\Public%` paths.
## Related Tools/Techniques
- **STATICPLUGIN:** The specific loader/orchestrator associated with this variant.
- **DLL Side-Loading (T1574.002):** The primary evasion technique.
- **Korplug:** A common alternative name for PlugX variants.