Vulnerabilities / Threats
9/13/2012
02:48 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Is 'Virus Expert' Tied To PlugX RAT Malware?

Security firm AlienVault believes "whg0001" helped create malware used to attack targets in Japan, South Korea, Taiwan, and Tibet.

Who Is Anonymous: 10 Key Facts
Who Is Anonymous: 10 Key Facts
(click image for larger view and for slideshow)
A virus expert who may be responsible for the development of PlugX, a Remote Access Tool, or RAT, used for several years to attack computers and steal data from targets in Asia, did not adequately clean and anonymize his code, one security researcher says.

Jaime Blasco, labs manager at AlienVault, has been tracking the activities of a group using PlugX and believes he has identified at least one of the people behind the malicious software.

Blasco in a phone interview said he was able to extract the debug file path from some PlugX malware binaries and then match those file paths to other PlugX samples, samples that included a username in the file path: "whg." The samples also suggested the author was using two separate systems for his work, a Windows XP system and a Vista/7 system.

Blasco scanned other binary files for similar debug file paths and identified an application called SockMon at the Chinese website cnasm.com. The website lists contact information for "whg0001," along with an email address and a QQ number, an identifier used on China's popular QQ messaging service.

[ Learn more about RATs. Read DarkComet Developer Retires Notorious Remote Access Tool. ]

InformationWeek sent an email to "whg0001" asking if he had a hand in the creation of PlugX, as Blasco alleges. We have not heard back.

As Blasco relates in a blog post about his findings, the email address associated with "whg0001" was used as an administrative contact to register a website in China in 2000. The company, Chinansl Technology Co. LTD is listed at Chengdu National Information Security Production Industrialization Base, 2nd Floor, No.8 Chuangye Road, Chengdu, China.

The company appears to have ties to the security industry in China, Blasco observes.

Blasco has found this same file path in components of Chinasl software called "Parent Carefree Filter" and that information about "whg0001" on the Internet identifies him as a "virus expert" who is "proficient in assembly."

A CSDN profile associated with the same whg0001" email address includes a picture.

Searching for more versions of the PlugX RAT reveals a connectivity test URL that points to another picture of the same individual.

Blasco concludes that based on this research, "we can say that this guy is behind the active development of the PlugX RAT."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Andrew Hornback
50%
50%
Andrew Hornback,
User Rank: Apprentice
9/15/2012 | 10:03:55 PM
re: Is 'Virus Expert' Tied To PlugX RAT Malware?
From the sound of it, this appears to have been a spying product - possibly created for the Chinese government, especially considering the targeted countries.

Get used to it folks, cyber weapons are all around us these days.

Remember, it's only malware if it does bad things to you. It's software if it does things for you.

Andrew Hornback
InformationWeek Contributor
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3562
Published: 2014-08-21
Red Hat Directory Server 8 and 389 Directory Server, when debugging is enabled, allows remote attackers to obtain sensitive replicated metadata by searching the directory.

CVE-2014-3577
Published: 2014-08-21
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-...

CVE-2014-5158
Published: 2014-08-21
The (1) av-centerd SOAP service and (2) backup command in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary commands via unspecified vectors.

CVE-2014-5159
Published: 2014-08-21
SQL injection vulnerability in the ossim-framework service in AlienVault OSSIM before 4.6.0 allows remote attackers to execute arbitrary SQL commands via the ws_data parameter.

CVE-2014-5210
Published: 2014-08-21
The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) remote_task or (2) get_license request, a different vulnerability than CVE-2014-3804 and CVE-2014-3805.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.