BKDR_PLUGX.DUKPF
Trojan:Win32/Plugx.E (Microsoft);
Windows
Threat Type: Backdoor
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
This backdoor may arrive bundled with malware packages as a malware component.
It executes commands from a remote malicious user, effectively compromising the affected system.
TECHNICAL DETAILS
Varies
DLL
Yes
13 Jul 2016
Collects system information, Steals information
Arrival Details
This backdoor may arrive bundled with malware packages as a malware component.
Installation
This backdoor drops the following component file(s):
- %Program Files%\Microsoft.NET\RedistList\KunlunPlatform.exe - non-malicious file used to load BKDR_PLUGX.DUKPF
- %Program Files%\Microsoft.NET\RedistList\DefMgr.dll - detected as BKDR_PLUGX.DUKPF
- %Program Files%\Microsoft.NET\RedistList\DefMgr.dll.rom - - detected as BKDR_PLUGX.ENC
(Note: %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.)
It is injected into the following processes running in memory:
- svchost.exe
- msiexec.exe
Autostart Technique
This backdoor registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\clr_optimization_v4.0.30512_32
ImageName = %Program Files%\Microsoft.NET\RedistList\KunlunPlatform.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\clr_optimization_v4.0.30512_32
DisplayName = Microsoft .NET Framework NGEN v4.0.30512_X86
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\clr_optimization_v4.0.30512_32
Microsoft .NET Framework NGEN v4.0.30512_X86 = Description
Backdoor Routine
This backdoor executes the following commands from a remote malicious user:
- Manage files, registries, services and directories
- Log keystrokes and active window
- Restart/Reboot/Shutdown system
- Enumerate processes
- Terminate processes
- Get drive information
- Enumerate network resources
- Set TCP connection state
- Lock workstation
- Display a message box
- Perfrom port mapping
- Capture screen
- Perform remote shell
Process Termination
This backdoor terminates the following processes if found running in the affected system's memory:
- explorer.exe
SOLUTION
9.750
12.660.08
17 Jun 2015
12.661.00
17 Jun 2015
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.
Step 3
Restart in Safe Mode
Step 4
Delete this registry key
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\clr_optimization_v4.0.30512_32
Step 5
Search and delete this file
- %Program Files%\Microsoft.NET\RedistList\KunlunPlatform.exe
- %Program Files%\Microsoft.NET\RedistList\DefMgr.dll
- %Program Files%\Microsoft.NET\RedistList\DefMgr.dll.rom
Step 6
Restart in normal mode and scan your computer with your Trend Micro product for files detected as BKDR_PLUGX.DUKPF. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.