https://www.botnets.fr/index.php?action=history&feed=atom&title=PlugX%3A_some_uncovered_points 2026-10-24T11:00:12Z Revision history for this page on the wiki MediaWiki 1.43.11 https://www.botnets.fr/index.php?title=PlugX:_some_uncovered_points&diff=5833&oldid=prev 2015-08-05T20:22:59Z

<p>Text replacement - &quot; blog.cassidiancybersecurity.com&quot; to &quot;&quot;</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 20:22, 5 August 2015</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l1">Line 1:</td> <td colspan="2" class="diff-lineno">Line 1:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>{{Publication</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>{{Publication</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Type=Blogpost</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Type=Blogpost</div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>|Link=http://blog.cassidiancybersecurity.com/2014/01/plugx-some-uncovered-points.html <del style="font-weight: bold; text-decoration: none;">blog.cassidiancybersecurity.com</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>|Link=http://blog.cassidiancybersecurity.com/2014/01/plugx-some-uncovered-points.html</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Author=Fabien Perigaud</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Author=Fabien Perigaud</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|NomRevue=Blog Cassidian Cybersecurity</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|NomRevue=Blog Cassidian Cybersecurity</div></td></tr> <!-- diff cache key wiki:diff:1.41:old-2956:rev-5833:php=table --> </table>

Eric.freyssinet https://www.botnets.fr/index.php?title=PlugX:_some_uncovered_points&diff=2956&oldid=prev 2015-02-07T14:30:22Z

<p>1 revision imported</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:30, 7 February 2015</td> </tr><tr><td colspan="4" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div> </td></tr> <!-- diff cache key wiki:diff:1.41:old-2955:rev-2956 --> </table>

Eric.freyssinet https://www.botnets.fr/index.php?title=PlugX:_some_uncovered_points&diff=2955&oldid=prev 2014-01-08T11:10:44Z

<p></p> <p><b>New page</b></p><div>{{Publication<br /> |Type=Blogpost<br /> |Link=http://blog.cassidiancybersecurity.com/2014/01/plugx-some-uncovered-points.html blog.cassidiancybersecurity.com<br /> |Author=Fabien Perigaud<br /> |NomRevue=Blog Cassidian Cybersecurity<br /> |Date=2014-01-06<br /> |Editor=Cassidian Cybersecurity<br /> |Year=2014<br /> |Botnet=PlugX<br /> |Abstract=PlugX (or Korplug, or Gulpix) is a well-known RAT involved in many APT cases. Some excellent write-ups about this malware have already been published by the CIRCL, Sophos and AlienVault.<br /> Since we met it on an incident response case back in 2012, we followed its evolution to improve our knowledge, rules and tools. We&#039;re planning to release details about this malware in a small serie of blog posts, to cover some points which have not been published yet.<br /> <br /> This first post will cover some internals of the original PlugX malware and we&#039;ll deal with its evolution in the next one.<br /> }}</div>

Eric.freyssinet