PlugX Uses Legitimate Samsung Application for DLL Side-Loading
Summary: Unit 42 observed threat actors using Samsung's legitimately signed RunHelp.exe application to side-load malicious ssMUIDLL.dll files that decrypt and execute PlugX, delivered via malicious Word and Excel documents exploiting CVE-2012-0158. The loader DLL includes junk code and a check that system time exceeds 20140606 to frustrate analysis, and the PlugX functional code stores itself in registry keys and creates a service named "ABC" to relaunch RunHelp.exe at startup.
What's compelling: The technique exploits no flaw in the Samsung binary - it simply hides malicious code behind a valid digital certificate from Samsung Electronics CO., LTD., so signature-based trust in signed executables does not help. The command-and-control domains capser.zues[.]info and casper.bacguarp[.]com were previously used in PlugX campaigns tied to CVE-2013-3906 and attacks on targets in Asia in July 2014, indicating the same infrastructure remains in play.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2012-0158
- Related
- When combining exploits for added effect goes wrong Cyber Risks ·Cmstar Downloader: Lurid and Enfal's New Cousin Cyber Risks ·