Detect PlugX Trojan Masquerading as a Legitimate Windows Debugger Tool to Fly Under the Radar

Old dog, new tricks! Security researchers revealed PlugX remote access Trojan (RAT) is masquerading as a popular open-source Windows debugger tool dubbed x65dbg. Relying on DLL side-loading for this spoofing trick, nefarious RAT is able to slip past security controls and gain full control over the targeted instance. 

PlugX Remote Access Trojan Detection

The PlugX Trojan, which has been actively leveraged in cyber attacks for over a decade, primarily being popular among Chinese hacking collectives, reemerges in the cyber threat arena. Concerned defenders warn organizations of a novel variant of PlugX attempting to fly under the radar by spoofing legitimate apps. SOC Prime’s Detection as Code Platform enables security teams to proactively detect current and emerging threats of any scale and sophistication, including novel malware samples. To help organizations timely identify the PlugX Trojan infection in their infrastructure, SOC Prime Platform has recently released a new Sigma rule written by our keen Threat Bounty developer, Emre Ay:

Possible PlugX Trojan Activity by Detection of Associated Commands (via process_creation)

This Sigma rule detects the PlugX Trojan activity related to the malware execution via the common adversary method known as rundll32, which enables defense evasion. The detection can be applied across 20+ SIEM, EDR, and XDR platforms and is mapped to the MITRE ATT&CK framework v12 addressing the Defense Evasion tactic with the System Binary Proxy Execution (T1218) as its primary technique.

Threat Hunters and Detection Engineers striving to contribute to collective intelligence are welcome to join the ranks of the Threat Bounty Program developers. By creating and sharing detection content with the peer-driven cyber defender community, aspiring security enthusiasts can master their Sigma and MITRE ATT&CK skills, code their CV, and self-advance in Detection Engineering while earning financial benefits for their contributions. 

Click the Explore Detections button below to instantly drill down to the entire list of Sigma rules for PlugX malware detection related to both the current cyber attack and previous malicious campaigns leveraging the infamous Trojan samples. All Sigma rules are enriched with relevant cyber threat intelligence to streamline investigation and provide a comprehensive context of the attacks and adversary behavior patterns. 

Explore Detections

Analyzing Latest PlugX Trojan Campaigns

PlugX (aka Korplug, Hodur, and RedDelta) first appeared in the malicious arena around 2008 being leveraged by miscreants as a backdoor to obtain full control over the targeted systems. Initially, the malware family was used by China-backed APT collectives explicitly. However, later multiple actors across the globe adopted PlugX RAT for their malicious operations. 

In the most recent attacks, hackers spoofed the 32-bit version of a Windows debugging tool known as x64dbg.exe.  PlugX RAT leveraged a malicious technique called DLL side-loading to drop a payload after hijacking the trusted legitimate app. The x64dbg debugger has been poisoned with an x32bridge.dll that loads the PlugX as x32bridge.dat.

Initially, the hijacked x64dbg version was revealed by Unit 42 experts in January 2023, while analyzing the new PlugX version relying on removable USB drives to infect other Windows machines on the targeted network. Persistence, in this case, is achieved via Windows Registry modifications and the creation of scheduled tasks ensuring continuous operation regardless of the machine restart. Further analysis by Trend Micro spotted the application of x32bridge.exe to drop a backdoor alongside a UDP shell client used to harvest system info. 

There is no silver bullet when it comes to modern security threats. With the continuous evolution of hacking techniques, cyber defenders require reliable solutions to timely identify threats before adversaries set up persistence mechanisms, steal data, or inject payloads. Rely on https://socprime.com/ to outsmart and outspeed threat actors having 10K+ Sigma rules always at hand.