PlugX (Korplug / SOGU): Forensic Reverse-Engineering & Architectural Dossier

PlugX (Korplug) is a foundational modular remote access Trojan utilized across the Chinese cyber espionage ecosystem since approximately 2008. The binary architecture pioneered the classic 'Triad' execution model: 1) A clean, legitimate executable carrying a trusted digital signature (e.g. McUtil.exe, RasTls.exe, kav.exe, bdagent.exe); 2) A malicious proxy DLL (e.g. McUtil.dll, RasTls.dll) placed in the same directory, which the host binary loads automatically upon startup; 3) An encrypted data file (e.g. McUtil.dat, RasTls.dat) containing raw shellcode prepended to an encrypted DLL payload. Upon execution, the loader DLL opens the .dat file, allocates heap or virtual memory (PAGE_EXECUTE_READWRITE), decrypts the shellcode, and transfers control to it. The shellcode performs in-memory reflective PE loading, resolving API addresses via PEB export walking, linking relocation tables, and executing the core PlugX RAT module.

The operator interface consists of a dedicated Win32 builder GUI allowing configuration of infection parameters: installation directories (%ALLUSERSPROFILE%, %APPDATA%, %SYSTEMROOT%\System32), service creation flags (Service Name, Display Name, Description), persistence registry keys, injection target processes (svchost.exe, explorer.exe, msiexec.exe), C2 hostnames/IPs, fallback DNS servers, TCP/UDP port tables, proxy credentials, keylogger configuration, and USB worm infection toggles. PlugX config profiles fall into two distinct structural models: Type I profiles utilize fixed-size structures (0xBE0 or 0x1B18 bytes) encrypted via static XOR keys; Type II profiles utilize variable-length structures (0x1D18 to 0x2400 bytes) encrypted with modified RC4 or rolling multi-byte XOR, featuring expanded DNS fallback arrays and P2P routing flags.

struct PlugX_(Korplug_/_SOGU)_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

PlugX unpacks into host memory without exposing unencrypted files on disk. The reflective loader allocates executable memory via VirtualAlloc, decrypts the embedded payload using an XOR loop or modified RC4 cipher, and executes the core entry point. For defense evasion, PlugX injects its core routines into benign host processes (typically svchost.exe or explorer.exe) via Process Hollowing or QueueUserAPC thread injection. The core framework contains specialized plugins: Disk (file browsing, transfer, deletion), Process (enumeration, privilege adjustment via AdjustTokenPrivileges SeDebugPrivilege), Service (SCM manipulation, driver installation), RegEdit (registry query and modification), Shell (interactive command prompt), Screen (remote desktop video streaming via GDI capture), Keylogger (WH_KEYBOARD_LL hook logging to encrypted files), and PortMap (TCP port forwarding and proxy bridging). Removable drive propagation is managed by registering a window message loop for WM_DEVICECHANGE (DBT_DEVICEARRIVAL). When a USB storage volume is detected, PlugX creates a hidden directory (e.g. 'RECYCLER.BIN' or 'System Volume Information'), writes the triad files into it, hides legitimate user folders, and generates weaponized Windows Shortcut (.LNK) files pointing to the benign executable with custom command arguments, enabling worm-like propagation across air-gapped networks.

Concrete technical breakdown of functional modules implemented in the PlugX (Korplug / SOGU) binary:

Network communications utilize custom binary framing prefixed with a 16-byte header: [DWORD Magic (e.g. 'XV', 'PLUG', 'GUST', 0x54535547)][DWORD CompressedLength][DWORD UncompressedLength][DWORD CommandCode]. The header bytes are obfuscated using a static or dynamic XOR key. Data payloads are compressed using a modified LZNT1 or LZO algorithm and encrypted with a custom 10-byte rolling XOR or RC4 cipher. Transport channels support raw TCP streams, UDP datagrams, ICMP echo tunneling (ICMP echo requests with embedded encrypted payload data), and HTTP/HTTPS encapsulation where command payloads are encoded in Base64 within HTTP Cookie or POST body parameters.

Indicators of compromise and forensic patterns recorded across laboratory triage: