Скачать или смотреть PlugX USB worm (Episode 3)

Now, we are analyzing the PlugX USB worm, which can infiltrate the air-gapped network. We downloaded from VX Underground two samples (loader and payload), which were mentioned in Sophos's report "A border-hopping PlugX USB worm takes its act on the road" (https[:]//news.sophos[.]com/en-us/2023/03/09/border-hopping-plugx-usb-worm/).

In this episode, we have started an advanced dynamic analysis of the payload decrypted from the "AvastAuth.dat" file. During the study, we recovered an initialization procedure, including creating working directories for the malware, initializing the exception processing function (I believe it is for the event of USB disk insertion), and installing through the "Run" registry key. In the following episodes, we will continue debugging this USB worm.