AlientVault Tracks Down Developer of PlugX RAT

-

Security experts at AlienVault have tracked down the creator of the PlugX Remote Access Tool (RAT), used in hacker attacks around the world. To their surprise, the brains behind the software was actually one of the directors of a Chinese IT company.
The sleuths analysed the traces of PlugX activity, and identified the suspected programmer, which led them to his address, photo and the name of the company he was working for – ChinaNSL Technology.

Digital detective work

AlienVault has been tracking PlugX, also known as Korplug, for the past few months, analysing the payloads of the attacks and collecting intelligence.
Malware builder known as “whg”
PlugX is a backdoor malware with a high damage potential. Once on the system, it executes commands from a remote malicious user, effectively compromising the affected computer.
The tool was mainly used by hackers in Japan, Taiwan, China, Korea and against Tibetan organizations. The security experts were almost certain that the creator of the malware has been participating in the attacks himself.
Over time, PlugX has been changing and adding capabilities, and there were several versions spotted around the Web. When comparing binaries of these versions, AlienVault found several instances of debug paths containing user name “whg”, and traces of another low-key hacking tool called SockMon.
A quick investigation of the cnasm.com website on which SockMon is hosted (located in China) yielded an email address: whg0001@163.com, which seemed to coincide with the user name found in the debug path of the RAT samples.
The researcher team then discovered that in 2000, the same email address was used as the administrative contact of the domain chinansl.com. The domain was registered to a representative of the ChinaNSL Technology with offices in Chengdu, Sichuansheng, China.
As it turned out,  ChinaNSL Technology is a cybersecurity company employing “whg”. AlienVault has found references to his work online, describing him as a “virus expert proficient in assembly”. A forum post which looks like a hacker directory says that “whg” “wrote a lot of software”, and identifies cnasm.com as his homepage.
This information led AlienVault to the suspect’s forum profile with a picture. Finally, the team confirmed that “whg” was responsible for PlugX after finding a link to his Baidu profile deep within a more recent version of the malware tool.
After the company published its findings, “whg” cleared his Baidu account. It is safe to assume his reputation would be damaged, but it is yet unclear if the law enforcement agencies will get involved.

JOIN US ON FACEBOOK:- CLICK HERE


Comments

Post a Comment

Popular posts from this blog

AntiCloud Trojan Reverse Engineering Analysis

-
Image
Introduction In this paper we are going to talk about the Anticloud Trojan, also know as the  TrojanDropper:Win32/Bohu.A and  B  variant. This malware originated in China and was designed to target the Cloud-Based Technology of major Chinese AntiVirus Vendors. For this reason, Bohu has also been called  AntiCloud Trojan . This is the first malware to specifically target cloud based technologies and will likely set a trend. As more corporations and governments move applications and services into the cloud, it will become an increasingly important target for malware developers. We can expect sophisticated malware that attacks clients and embeds itself into cloud-based apps, potentially without the user being able to determine that the cloud-based service is compromised. This trojan presents some interesting features, such as: Hash Check Evasion. Packet Interception via NDIS Filter. Cloud-Servers Access Lock via SPI network filter in order to Bypass antivirus Detection. So
Read more

SQL Injection: The Equal Opportunity Vulnerability

-
Image
Introduction In the  first installment of this series , we discussed application security within the Software Development Process by demystifying the adoption of security controls within the development organization. We also took a deeper dive into identifying potential vulnerabilities based on threats to attack surfaces exposed to the application, a process known as threat modeling. In this installment, we are going to take a technical dive into specific vulnerabilities that can be used to compromise the attack surfaces and discuss what is arguably one of the most prevalent attacks to applications and inflicts the most exposure of sensitive data: SQL Injection. Injection attacks attempt to infiltrate an application by injecting malicious content into the application through available input channels. Input channels can be in the form of form fields, uploads, 3 rd  party API, data access channels, configuration files, input files: essentially, any point at which the application r
Read more

Secure Sockets Layer (SSL)

-
Image
Secure Sockets Layer (SSL): How It Works What Happens When a Browser Encounters SSL > A browser attempts to connect to a website secured with SSL. > The browser requests that the web server identify itself. > The server sends the browser a copy of its SSL Certificate. > The browser checks whether it trusts the SSL Certificate. If so, it sends a    message to the server. > The server sends back a digitally signed acknowledgement to start an SSL encrypted session. > Encrypted data is shared between the browser and the server. Encryption Protects Data During Transmission Web servers and web browsers rely on the Secure Sockets Layer (SSL) protocol to help users protect their data during transfer by create a uniquely encrypted channel for private communications over the public Internet. Each SSL Certificate consists of a key pair as well as verified identification information. When a web browser (or client) points to a secured website, th
Read more