Search/PlugX
● Malware

PlugX

PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.

View graph Watch Export
Indicators tracked
0
Intelligence Reports60
60 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
121 relationships
T1053.005: Scheduled Task
source
T1113: Screen Capture
source
T1033: System Owner/User Discovery
source
T1056.001: Keylogging
source
T1027.013: Encrypted/Encoded File
source
T1071.004: DNS
source
T1074.001: Local Data Staging
source
T1036.005: Match Legitimate Resource Name or Location
source
T1204.002: Malicious File
source
T1573.001: Symmetric Cryptography
source
T1543.003: Windows Service
source
T1497.001: System Checks
source
T1574.001: DLL
source
T1135: Network Share Discovery
source
T1120: Peripheral Device Discovery
source
T1082: System Information Discovery
source
T1106: Native API
source
T1091: Replication Through Removable Media
source
T1140: Deobfuscate/Decode Files or Information
source
T1620: Reflective Code Loading
source
T1480.002: Mutual Exclusion
source
T1112: Modify Registry
source
T1027.001: Binary Padding
source
T1016: System Network Configuration Discovery
source
T1083: File and Directory Discovery
source
T1036.004: Masquerade Task or Service
source
T1049: System Network Connections Discovery
source
T1057: Process Discovery
source
T1041: Exfiltration Over C2 Channel
source
T1547.001: Registry Run Keys / Startup Folder
source
T1571: Non-Standard Port
source
T1027: Obfuscated Files or Information
source
T1095: Non-Application Layer Protocol
source
T1012: Query Registry
source
T1614: System Location Discovery
source
T1127.001: MSBuild
source
T1564.003: Hidden Window
source
T1059.003: Windows Command Shell
source
T1070.009: Clear Persistence
source
T1070.004: File Deletion
source
Loading 9 more…