Threat Encyclopedia

This malware is a remote access tool (RAT) known as PlugX. It is one of the most common malware used in carrying out targeted attacks. The targeted attacks it has been involved in are mostly directed towards government institutions in Japan.

To get a one-glance comprehensive view of the behavior of this Backdoor, refer to the Threat Diagram shown below.

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This backdoor creates the following folders:

• %User Profile%\UdpGf
• %User Profile%\SxS
• %All Users Profile%\Gf
• %All Users Profile%\SxS

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Other System Modifications

This backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\Software\CLASSES\
FAST

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
FAST
CLSID = "{random values}"

Dropping Routine

This backdoor drops the following files:

• %User Profile%\UdpGf\NvSmart.usr
• %User Profile%\UdpGf\NvSmart.exe
• %User Profile%\UdpGf\NvSmartMax.dll
• %All Users Profile%\Gf\boot.ldr
• %All Users Profile%\Gf\NvSmart.exe
• %All Users Profile%\Gf\NvSmartMax.dll

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Other Details

This backdoor deletes itself after execution.