Trusted Design

Korplug RAT used to attack Vietnamese institutions

概要

Recently Malwarebytes got access to several elements of the espionage toolkit that has been captured attacking Vietnamese institutions. During the operation, the malware was used to dox 400,000 members of Vietnam Airlines. The payload, distributed disguised as antivirus, is a variant of Korplug RAT (aka PlugX) – a spyware with former associations with Chinese APT groups, and known from targeted attacks at important institutions of various countries. In this article we will describe the process of extracting the final payload out of it’s cover.

Created: 2026-02-23

Indicators

• FileHash-MD5 - 321a2f0abe47977d5c8663bd7a7c7d28 -
• YARA - 662c8c460cadc8d76bab3014fccec768b7c1b7ac -
• hostname - air.dscvn.org -
• FileHash-SHA256 - c437465db42268332543fbf6fd6a560ca010f19e0fd56562fb83fb704824b371 -
• YARA - 0fbcc8b75ac516520e38aaffb405f2adc14571d4 -
• FileHash-MD5 - c52464e9df8b3d08fc612a0f11fe53b2 -
• FileHash-MD5 - 28f151ae7f673c0cf369150e0d44e415 -

類似Pulses

• Defending the White Elephant (score: 0.75)
• APT group leveraging HT exploits to target a Financial Services (score: 0.68)
• Payloads from MS15-093 (PlugX) (score: 0.67)
• Operation Potao Express (score: 0.65)
• BBSRAT Attacks Targeting Russian Organizations (score: 0.62)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る