Paranoid PlugX
Summary: Unit 42 documented a PlugX campaign, delivered via an RTF exploiting CVE-2017-0199 that pulled payloads from 172.104.65[.]97, whose targets appeared to be primarily video game companies. The attackers chained a .NET wrapper that checked for the process vmtoolsd, a registry RunOnce entry named 'MSASCuiLTasks', shellcode unpacking a PlugX DLL with XV substituted for the MZ/PE headers, and C2 addresses hidden in Pastebin posts between the magic values 'DZKS' and 'DZJS'.
Bottom line: A related 'paranoid' variant ran a batch script that deleted its own on-disk and registry traces, running most deletion commands more than once, so memory or network detection would be required to find the intrusion. The same actor also pasted shellcode into SubTee's public templates to launch PlugX under msbuild.exe and other trusted applications, bypassing the application allowlisting many defenders treat as a primary control.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2017-0199
- Related
- My Little Form Book Cyber Risks ·