THOR
Description
(Palo Alto) While monitoring the Microsoft Exchange Server attacks in March 2021, Unit 42 researchers identified a PlugX variant delivered as a post-exploitation remote access tool (RAT) to one of the compromised servers. The variant observed by Unit 42 is unique in that it contains a change to its core source code: the replacement of its trademark word “PLUG” to “THOR.” The earliest THOR sample uncovered was from August 2019, and it is the earliest known instance of the rebranded code. New features were observed in this variant, including enhanced payload-delivery mechanisms and abuse of trusted binaries.
Names
| Name |
|---|
| THOR |
Category
Malware
Type
- Reconnaissance
- Backdoor
- Keylogger
- Info stealer
- Exfiltration
Information
Other Information
Uuid
18a9e8eb-f9b6-4a27-ba41-66c10d003cd9
Last Card Change
2021-08-09