TrojanDropper:PowerShell/Plugx.A!dha

The TrojanDropper:PowerShell/Plugx.A!dha infection chain begins with the initial access stage. A threat actor sends a spear phishing email that contains a link to a malicious archive or a weaponized document. The primary delivery vehicle is a Microsoft Shortcut (LNK) file modified to exploit a flow that allows a lengthy PowerShell command to be hidden inside the shortcut COMMAND_LINE_ARGUMENTS structure by using extreme whitespace padding. When the user clicks the shortcut, the Windows Shell ignores the padding and runs the hidden PowerShell command with flags such as WindowStyle hidden, ExecutionPolicy Bypass, and NoProfile. The initial script is a small stager that reaches a remote server and downloads a secondary archive, for example a tape archive (TAR) or ZIP file, to the user’s temporary folder. To avoid raising suspicion, the script may also open a decoy PDF document that matches the email theme. Indicators at this stage include the delivery archive named rjnlzlkfe.ta, the decoy document named Agenda_Meeting.pdf and download domains such as mydownfile[.]z11[.]web[.]core[.]windows[.]net and d32tpl7xt7175h[.]cloudfront[.]net. Observed C2 IP addresses include 160[.]20[.]147[.]254, 172[.]104[.]65[.]97, 103[.]56[.]53[.]46, and 45[.]142[.]166[.]112. 

In the second stage, the PowerShell script uses native utilities like tar.exe or expand.exe to decompress the downloaded archive. It writes three files to a hidden or disguised directory: a legitimate signed executable, a malicious loader library, and an encrypted data blob. The script also run environment checks, such as looking for vmtoolsd.exe to detect virtual machines or verifying the system year is later than 2012 to avoid sandboxes. The loader library is typically small (around 4 KB) and its only purpose is to decrypt the third file using the RC4 algorithm with a 16-byte hardcoded key. Specific file names observed in campaigns include the legitimate executable cnmpaui.exe (a signed printer utility), the malicious loader cnmpaui.dll, and the encrypted payload blob cnmplog.dat. The PowerShell script may use randomized URL parameters to evade basic traffic filters.

The third stage uses DLL side loading to achieve memory only infection. The PowerShell script launches the legitimate signed binary. Because that binary load cnmpaui.dll without verifying its signature, the malicious version is loaded into the process space of the trusted utility. The loader then decrypts the payload blob and manually maps the PlugX DLL directly into memory, never writing it to disk. The launch is triggered through Windows callback functions such as EnumSystemGeoID or EnumFontsW. The final payload exists only in volatile memory, which makes it invisible to file system scans. For persistence, the malware adds a Registry Run key named CanonPrinter or similar. Other observed process names used in different variants include GlobalProtect.exe (pretending to be security software) and x32dbg.exe (a legitimate debugger). Command and control communication typically uses port 443 for HTTPS, but the malware also supports TCP, UDP, ICMP, and DNS. A peer-to-peer function uses port 1357 for internal scanning. The threat actor hide C2 addresses by retrieving them from Pastebin URLs, extracting an encrypted string, and decoding it to find the real server IP. Traffic is often encrypted with AES or custom XOR algorithms to avoid network detection.