Payloads from MS15-093 (PlugX)
released on 2015-09-07 @ 10:07:19 AM
The recent vulnerability of MS15-093 revealed that attackers were using it distribute the Korplug/Plugx RAT. After obtaining a sample from this attack and conducting further analysis, we found that the attackers have been using the same payload and just altering its configurations in attacks since March of this year.