Article Content PlugX     This is Shusei Tomonaga at Analysis Center PlugX, a Remote Access Tool (RAT) often seen in many APT cases, has been in the wild for some years Various sectors in Japan have been suffering from this type of attack from 2012, and Analysis Center has been working to catch up on the evolution of the PlugX family since then In this blog post, I will write about a recent PlugX variant which we first encountered in October 2014 The variant has interesting new aspects and the most significant one, in my view, is the P2P function - so let me tentatively name it “P2P PlugX” Our analysis revealed that the size of the configuration information has been expanded for the recent variant While the former ones have either 0x2540 bytes (Observed since August 2013) or 0x2d58 bytes (Observed since June 2014), the recent one has 0x36a4 bytes, roughly 20% larger in size I will pick up some of the interesting features for more description For details of the configuration file, you can refer to Appendix A in the bottom of this post Additional Communication Protocol for C&C Servers Former versions of PlugX used to set four C&C Server addresses to communicate with With the P2P PlugX, attackers can set up to 16 C&C servers Communication protocol with C&C servers has also been improved Former PlugX could only configure four communication protocols, but for P2P PlugX, protocol number 255 became available This protocol is reserved by IANA, but no specific application is assigned Table 1: Configurations and Communication Protocol which PlugX uses to connect to C&C Servers   Configuration No Protocol Number(In IP header) Data Format   1 6 (TCP) Binary   2 6 (TCP) HTTP   3 17 (UDP) DNS   4 1 (ICMP) Binary   5 255 Binary    P2P Function Enabled P2P PlugX can communicate with other similarly-infected hosts Table 2: Configurations and Communication Protocols which P2P PlugX uses to communicate by P2P   Configuration No Protocol Number(In IP header) Data Format   1 6 (TCP) Binary   2 17 (UDP) DNS   3 1 (ICMP) Binary   4 255 Binary    With P2P protocol, even if a PlugX exists in an environment with no direct access to the Internet, it may communicate with C&C server through other infected hosts We have also seen some P2P-disabled samples Note that this P2P communication theoretically can be applied to any other TCP/UDP ports But in cases which JPCERT/CC haｓ observed, P2P PlugX only uses either TCP/1357 or UDP/1357 for P2P communication If you see any scanning activity to TCP/1357 or UDP/1357, we highly recommend that you conduct further investigation New Encoding Algorithm PlugX uses a single encoding algorithm for inbound/outbound data, configuration, key logging data and strings used internally Likewise, P2P PlugX has a new encoding algorithm def plugx_decode(data):     decode_key = struct.unpack_from('<I', data, 0)[0]     out = ''          # XOR Values might possibly be varied key1 = decode_key ^ 20140918     key2 = decode_key ^ 353          for c in data[4:]:         # ADD/SUB Values might possibly be varied key1 += 3373         key2 -= 39779                  dec = ord(c) ^ (((key2 >> 16) & 0xff ^ ((key2 & 0xff ^ (((key1 >> 16) & 0xff ^ (key1 - (key1 >> 8) & 0xff)) - (key1 >> 24) & 0xff)) - (key2 >> 8) & 0xff)) - (key2 >> 24) & 0xff)         out = out + chr(dec)          return out  What’s Next? P2P PlugX introduced several new features which surely made attackers to manage their attack infrastructure efficiently We are sure that PlugX will keep evolving, and continuous analysis will be necessary for preventing/mitigating possible incident We will keep you updated on any new findings Thank you very much for reading Prior to joining JPCERT/CC, he was engaged in security monitoring and analysis operations at a foreign-affiliated IT vendor He presented at CODE BLUE, BsidesLV, BlackHat USA Arsenal, Botconf, PacSec and FIRST Conference JSAC organizer Bug in Malware “TSCookie” - Fails to Read Configuration -        Volatility Plugin for Detecting Cobalt Strike Beacon        Malware “WellMess” Targeting Linux and Windows        PLEAD Downloader Used by BlackTech        Malware “TSCookie”
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content PlugX     This is Shusei Tomonaga at Analysis Center PlugX, a Remote Access Tool (RAT) often seen in many APT cases, has been in the wild for some years Various sectors in Japan have been suffering from this type of attack from 2012, and Analysis Center has been working to catch up on the evolution of the PlugX family since then In this blog post, I will write about a recent PlugX variant which we first encountered in October 2014 The variant has interesting new aspects and the most significant one, in my view, is the P2P function - so let me tentatively name it “P2P PlugX” Our analysis revealed that the size of the configuration information has been expanded for the recent variant While the former ones have either 0x2540 bytes (Observed since August 2013) or 0x2d58 bytes (Observed since June 2014), the recent one has 0x36a4 bytes, roughly 20% larger in size I will pick up some of the interesting features for more description For details of the configuration file, you can refer to Appendix A in the bottom of this post Additional Communication Protocol for C&C Servers Former versions of PlugX used to set four C&C Server addresses to communicate with With the P2P PlugX, attackers can set up to 16 C&C servers Communication protocol with C&C servers has also been improved Former PlugX could only configure four communication protocols, but for P2P PlugX, protocol number 255 became available This protocol is reserved by IANA, but no specific application is assigned Table 1: Configurations and Communication Protocol which PlugX uses to connect to C&C Servers   Configuration No Protocol Number(In IP header) Data Format   1 6 (TCP) Binary   2 6 (TCP) HTTP   3 17 (UDP) DNS   4 1 (ICMP) Binary   5 255 Binary    P2P Function Enabled P2P PlugX can communicate with other similarly-infected hosts Table 2: Configurations and Communication Protocols which P2P PlugX uses to communicate by P2P   Configuration No Protocol Number(In IP header) Data Format   1 6 (TCP) Binary   2 17 (UDP) DNS   3 1 (ICMP) Binary   4 255 Binary    With P2P protocol, even if a PlugX exists in an environment with no direct access to the Internet, it may communicate with C&C server through other infected hosts We have also seen some P2P-disabled samples Note that this P2P communication theoretically can be applied to any other TCP/UDP ports But in cases which JPCERT/CC haｓ observed, P2P PlugX only uses either TCP/1357 or UDP/1357 for P2P communication If you see any scanning activity to TCP/1357 or UDP/1357, we highly recommend that you conduct further investigation New Encoding Algorithm PlugX uses a single encoding algorithm for inbound/outbound data, configuration, key logging data and strings used internally Likewise, P2P PlugX has a new encoding algorithm def plugx_decode(data):     decode_key = struct.unpack_from('<I', data, 0)[0]     out = ''          # XOR Values might possibly be varied key1 = decode_key ^ 20140918     key2 = decode_key ^ 353          for c in data[4:]:         # ADD/SUB Values might possibly be varied key1 += 3373         key2 -= 39779                  dec = ord(c) ^ (((key2 >> 16) & 0xff ^ ((key2 & 0xff ^ (((key1 >> 16) & 0xff ^ (key1 - (key1 >> 8) & 0xff)) - (key1 >> 24) & 0xff)) - (key2 >> 8) & 0xff)) - (key2 >> 24) & 0xff)         out = out + chr(dec)          return out  What’s Next? P2P PlugX introduced several new features which surely made attackers to manage their attack infrastructure efficiently We are sure that PlugX will keep evolving, and continuous analysis will be necessary for preventing/mitigating possible incident We will keep you updated on any new findings Thank you very much for reading Prior to joining JPCERT/CC, he was engaged in security monitoring and analysis operations at a foreign-affiliated IT vendor He presented at CODE BLUE, BsidesLV, BlackHat USA Arsenal, Botconf, PacSec and FIRST Conference JSAC organizer Bug in Malware “TSCookie” - Fails to Read Configuration -        Volatility Plugin for Detecting Cobalt Strike Beacon        Malware “WellMess” Targeting Linux and Windows        PLEAD Downloader Used by BlackTech        Malware “TSCookie” ### Response: .