Vulnerabilitycritical
THOR: Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2021-26855+1 related CVE | Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon) | 9.1 group max | 100% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cabsecnow.com | d to throughout the course of 2020. One such domain was www.cabsecnow[.]com , which was used as a C2 channel for another PlugX sample |
| domain | cqpeizi.com | First seen in March 2021, this sample's C2 references news.cqpeizi[.]com , which since late 2019 resolves to the loopback address |
| domain | indonesiaport.info | 61.182[.]34 for its C2 communication, which resolved to the indonesiaport[.]info[10] domain between September 2019 and February 2020. The |
| domain | ixiaoyver.com | tracked by Unit 42 and other vendors. Examples include www.ixiaoyver[.]com and www.systeminfor[.]com that resolved in April and May |
| domain | manager2013.com | 4AD457EA052BA29BD7A7B806AB63B4 )[3] from late 2020 using C2 manager2013[.]com. Other samples from the set using the common registry key |
| domain | rainydaysweb.com | implant is configured for the following: Four C2 domains of rainydaysweb[.]com Communication with ports: 80 , 443 , 53 and 8000 . Data i |
| domain | scbbgroup.com | ctober 2020. The C2 channel from the configuration is tools.scbbgroup[.]com , which at the time resolved to 167.88.180[.]131 , and si |
| domain | systeminfor.com | other vendors. Examples include www.ixiaoyver[.]com and www.systeminfor[.]com that resolved in April and May 2020 respectively to 103.8 |
| domain | tibetsl.com | sted around the same timeframe (June 2018) using the domain tibetsl[.]com and many third-level domains from it for C2 communication |
| domain | ukbbcnews.com | tion information relating to the third-level domain, upload.ukbbcnews[.]com [4]. This domain is not and has never been a legitimate B |
| ipv4 | 101.36.120.227 | CVE-2021-27065), known as ProxyLogon , originating from IP 101.36.120[.]227 . Upon successful exploitation, a webshell was uploaded t |
| ipv4 | 103.85.24.158 | , and since early February 2021, it continues to resolve to 103.85.24[.]158 under the ASNs 6134 and 134835, respectively[12]. Other k |
| ipv4 | 103.85.24.190 | r[.]com that resolved in April and May 2020 respectively to 103.85.24[.]190 , which acted as C2 channels for several PlugX samples (u |
| ipv4 | 108.61.182.34 | FAD5D9A8FE1026141A832E05C9CA03A88FEE96587921F42773D4 ) used 108.61.182[.]34 for its C2 communication, which resolved to the indonesia |
| ipv4 | 167.88.180.131 | on is tools.scbbgroup[.]com , which at the time resolved to 167.88.180[.]131 , and since early February 2021, it continues to resolve |
| ipv4 | 167.88.180.32 | lved to 103.85.24[.]190 , the resolution briefly changed to 167.88.180[.]32 (ASN 6134), which other PKPLUG-related domains resolved t |
| ipv4 | 185.239.226.14 | ASN range, including 185.239.226[.]65, 185.239.226[.]76 and 185.239.226[.]14 , which have been used as C2 channels for various PlugX s |
| ipv4 | 185.239.226.65 | d to some IPv4 addresses in the 134835 ASN range, including 185.239.226[.]65, 185.239.226[.]76 and 185.239.226[.]14 , which have been |
| ipv4 | 185.239.226.76 | resses in the 134835 ASN range, including 185.239.226[.]65, 185.239.226[.]76 and 185.239.226[.]14 , which have been used as C2 channel |
| ipv4 | 45.248.87.217 | ar as such to victims. This domain resolved to IPv4 address 45.248.87[.]217 up until April 12, 2021, providing the C2 channel for Plu |
| sha256 | 125fdf108dc1ad6f572cbdde74b0c7fa938a9adce0cc80cb5ce00f1c030b0c93 | e using the THOR identifier [14] is SmadHook32.dll (SHA256: 125FDF108DC1AD6F572CBDDE74B0C7FA938A9ADCE0CC80CB5CE00F1C030B0C93 ) and its configuration module Smadav.dat (SHA256: CC1AFB37 |
| sha256 | 18a98c2d905a1da1d9d855e86866921e543f4bf8621faea05eb14d8e5b23b60c | ieved. VirusTotal has the following files: Aro.exe (SHA256: 18A98C2D905A1DA1D9D855E86866921E543F4BF8621FAEA05EB14D8E5B23B60C ) Aross.dll (SHA256: 9FFFB3894B008D5A54343CCF8395A47ACFE953 |
| sha256 | 3c5e2a4afe58634f45c48f4e800dc56bae3907dde308ff97740e9cd5684d1c53 | 0144E0280 )[11] loaded by PlugX sample Acrobat.dll (SHA256: 3C5E2A4AFE58634F45C48F4E800DC56BAE3907DDE308FF97740E9CD5684D1C53 ) was first seen at the end of October 2020. The C2 channel |
| sha256 | 3cdd33dea12f21a4f222eb060e1e8ca8a20d5f6ca0fd849715f125b973f3a257 | ingly throughout 2018, 2019 and 2020. PlugX sample (SHA256: 3CDD33DEA12F21A4F222EB060E1E8CA8A20D5F6CA0FD849715F125B973F3A257 )[6] from June 2018 shares behavioral traits, namely settin |
| sha256 | 59ba902871e98934c054649ca582e2a01707998acc78b2570fef43dbd10f7b6f | s used to download an innocuous file named Aro.dat (SHA256: 59BA902871E98934C054649CA582E2A01707998ACC78B2570FEF43DBD10F7B6F ) from an actor-controlled GitHub repo to the target. (See |
| sha256 | 64e2fe0e9d52812d2da956b1d92b51e7c215e579241649316cf996f9721e466e | 49667CD08618D87 )[5] with its THOR module mpsvc.ui (SHA256: 64E2FE0E9D52812D2DA956B1D92B51E7C215E579241649316CF996F9721E466E ) from early August 2020. Other "ukbbcnews" third-level dom |
| sha256 | 690c488a9902978f2ef05aa23d21f4fa30a52dd9d11191f9b49667cd08618d87 | 2, 2021, providing the C2 channel for PlugX sample (SHA256: 690C488A9902978F2EF05AA23D21F4FA30A52DD9D11191F9B49667CD08618D87 )[5] with its THOR module mpsvc.ui (SHA256: 64E2FE0E9D52812 |
| sha256 | 80deed939a520696968335d1bb2a9fcce7053c0156f679ba261824d0a2d44967 | m it for C2 communication. The third PlugX sample, (SHA256: 80DEED939A520696968335D1BB2A9FCCE7053C0156F679BA261824D0A2D44967 )[9], from the set also used the THOR identifier. From Nove |
| sha256 | 93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e | ] that references parts of Figure 12. PlugX sample (SHA256: 93D33626886E97ABF4087F5445B2A02738EA21D8624B3F015625CD646E9D986E )[1], first seen March 19, 2021, uses the traditional PLUG |
| sha256 | 9fffb3894b008d5a54343ccf8395a47acfe953394fffe2c58550e444ff20ec47 | 66921E543F4BF8621FAEA05EB14D8E5B23B60C ) Aross.dll (SHA256: 9FFFB3894B008D5A54343CCF8395A47ACFE953394FFFE2C58550E444FF20EC47 ) Open-source research suggests Aro.exe is part of the “ AR |
| sha256 | a15fed60e69ec07bfd01a23beec2c8e9b14ad457ea052ba29bd7a7b806ab63b4 | PKPLUG activity in the past, such as PlugX sample (SHA256: A15FED60E69EC07BFD01A23BEEC2C8E9B14AD457EA052BA29BD7A7B806AB63B4 )[3] from late 2020 using C2 manager2013[.]com. Other sampl |
| sha256 | a68ca9d35d26505a83c92202b0220f7bb8f615bc1e8d4e2266aaddb0dfe7bd15 | eys used by Aro.dat and an older 2012 PlugX sample (SHA256: A68CA9D35D26505A83C92202B0220F7BB8F615BC1E8D4E2266AADDB0DFE7BD15 ). The decryption routine differs slightly with each PlugX |
| sha256 | a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91 | changed the value of that registry key, one sample (SHA256: A9511CDAA96ED59DE73A7A7C7DC375DE204BEE7A9511C5EE71BF013010324A91 )[8] existed around the same timeframe (June 2018) using th |
| sha256 | a9cbce007a7467ba1394eed32b9c1774ad09a9a9fb74eb2ccc584749273fac01 | was used as a C2 channel for another PlugX sample (SHA256: A9CBCE007A7467BA1394EED32B9C1774AD09A9A9FB74EB2CCC584749273FAC01 )[13] and configuration module Smadav.dat (SHA256: E2D21B5E |
| sha256 | b5c0db62184325ffbe2b8ef7e6f13f5d5926deac331ef6d542c5fa50144e0280 | tion module using the THOR identifier, acrobat.chm (SHA256: B5C0DB62184325FFBE2B8EF7E6F13F5D5926DEAC331EF6D542C5FA50144E0280 )[11] loaded by PlugX sample Acrobat.dll (SHA256: 3C5E2A4AF |
| sha256 | c5dcd3073904fad5d9a8fe1026141a832e05c9ca03a88fee96587921f42773d4 | this sample and its configuration module aross.dat (SHA256: C5DCD3073904FAD5D9A8FE1026141A832E05C9CA03A88FEE96587921F42773D4 ) used 108.61.182[.]34 for its C2 communication, which reso |
| sha256 | cc1afb373f8286c08869cd786fee75b8002df595586e00255f52892016fd7a4f | 030B0C93 ) and its configuration module Smadav.dat (SHA256: CC1AFB373F8286C08869CD786FEE75B8002DF595586E00255F52892016FD7A4F ) is the most recent THOR sample Unit 42 has discovered. Fi |
| sha256 | e2d21b5e34189fa1aca39a13a405c792b19b6edf020907fb9840af1aafbaa2f4 | 273FAC01 )[13] and configuration module Smadav.dat (SHA256: E2D21B5E34189FA1ACA39A13A405C792B19B6EDF020907FB9840AF1AAFBAA2F4 ) using the THOR magic bytes in August 2020. The final Plug |
From the original article
13 min read at unit42.paloaltonetworks.com
While monitoring the Microsoft Exchange Server attacks in March 2021, Unit 42 researchers identified a PlugX variant delivered as a post-exploitation remote access tool (RAT) to one of the compromised servers. The variant observed by Unit 42 is unique in that it contains a change to its core source code: the replacement of its trademark word “PLUG” to “THOR.”
By Mike Harbison, Alex Hinchliffe · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.