Vulnerabilities / Threats
9/13/2012
02:48 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Is 'Virus Expert' Tied To PlugX RAT Malware?

Security firm AlienVault believes "whg0001" helped create malware used to attack targets in Japan, South Korea, Taiwan, and Tibet.

Who Is Anonymous: 10 Key Facts
Who Is Anonymous: 10 Key Facts
(click image for larger view and for slideshow)
A virus expert who may be responsible for the development of PlugX, a Remote Access Tool, or RAT, used for several years to attack computers and steal data from targets in Asia, did not adequately clean and anonymize his code, one security researcher says.

Jaime Blasco, labs manager at AlienVault, has been tracking the activities of a group using PlugX and believes he has identified at least one of the people behind the malicious software.

Blasco in a phone interview said he was able to extract the debug file path from some PlugX malware binaries and then match those file paths to other PlugX samples, samples that included a username in the file path: "whg." The samples also suggested the author was using two separate systems for his work, a Windows XP system and a Vista/7 system.

Blasco scanned other binary files for similar debug file paths and identified an application called SockMon at the Chinese website cnasm.com. The website lists contact information for "whg0001," along with an email address and a QQ number, an identifier used on China's popular QQ messaging service.

[ Learn more about RATs. Read DarkComet Developer Retires Notorious Remote Access Tool. ]

InformationWeek sent an email to "whg0001" asking if he had a hand in the creation of PlugX, as Blasco alleges. We have not heard back.

As Blasco relates in a blog post about his findings, the email address associated with "whg0001" was used as an administrative contact to register a website in China in 2000. The company, Chinansl Technology Co. LTD is listed at Chengdu National Information Security Production Industrialization Base, 2nd Floor, No.8 Chuangye Road, Chengdu, China.

The company appears to have ties to the security industry in China, Blasco observes.

Blasco has found this same file path in components of Chinasl software called "Parent Carefree Filter" and that information about "whg0001" on the Internet identifies him as a "virus expert" who is "proficient in assembly."

A CSDN profile associated with the same whg0001" email address includes a picture.

Searching for more versions of the PlugX RAT reveals a connectivity test URL that points to another picture of the same individual.

Blasco concludes that based on this research, "we can say that this guy is behind the active development of the PlugX RAT."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Andrew Hornback
50%
50%
Andrew Hornback,
User Rank: Apprentice
9/15/2012 | 10:03:55 PM
re: Is 'Virus Expert' Tied To PlugX RAT Malware?
From the sound of it, this appears to have been a spying product - possibly created for the Chinese government, especially considering the targeted countries.

Get used to it folks, cyber weapons are all around us these days.

Remember, it's only malware if it does bad things to you. It's software if it does things for you.

Andrew Hornback
InformationWeek Contributor
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3090
Published: 2014-09-23
IBM Rational ClearCase 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

CVE-2014-3101
Published: 2014-09-23
The login form in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not insert a delay after a failed authentication attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.

CVE-2014-3103
Published: 2014-09-23
The Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http...

CVE-2014-3104
Published: 2014-09-23
IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

CVE-2014-3105
Published: 2014-09-23
The OSLC integration feature in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account n...

Best of the Web
Dark Reading Radio