Earth Preta Hackers Abuses Google Drive to Deploy DOPLUGS Malware

Threat actors abuse Google Drive for several malicious activities due to its widespread use, easy file sharing, and collaboration features.

These things provide a convenient platform to host and distribute malware. Integration with legitimate services makes detecting and blocking malicious content challenging.

Cybersecurity researchers at Check Point recently found SMUGX in July 2023, linked to Earth Preta, hitting Europe. They also found a phishing email with PlugX in Taiwan tied to SMUGX.

Researchers found a new variant, DOPLUGS, which differs from typical PlugX and is mainly used for downloading. 

It employs the KillSomeOne module and was first reported by Sophos in 2020. Earth Preta campaign researchers analyze DOPLUGS, noting its backdoor commands, integration with KillSomeOne, and changes over time.

Live Account Takeover Attack Simulation

How do Hackers Bypass 2FA?

Live attack simulation Webinar demonstrates various ways in which account takeover can happen and practices to protect your websites and APIs against ATO attacks .

Book Your Spot

Technical analysis

DOPLUGS files found since July 2023 indicate victims from Taiwan and Mongolia. File names suggest social engineering tied to recent events, like the January 2024 Taiwanese presidential election.

The “水源路二至五期整建住宅都市更新推動說明.pdf” decoy file relates to a Taiwanese urban renewal project in traditional Chinese.

The Үер усны сэрэмжлүүлэг.pdf decoy warns of floods in Mongolia, in Mongolian. From 2022-2023 VirusTotal data (Asia-focused), Taiwan and Vietnam were prime targets, with fewer attacks in China, Singapore, Hong Kong, Japan, India, Malaysia, and Mongolia.

The spear-phishing emails carry a Google Drive link, which leads to a password-protected archive with DOPLUGS malware. 

Disguised as documents, LNK files in the RAR archive download MSI files from https://getfiledown[.]com/vgbskgyu, which helps trigger subsequent file drops.

• %localappdata%\MPTfGRunFbCn\OneNotem.exe (legitimate executable)
• %localappdata%\MPTfGRunFbCn\msi.dll (malicious DLL file)
• %localappdata%\MPTfGRunFbCn\NoteLogger.dat (encrypted payload)

DOPLUGS includes four backdoor commands, as it is a downloader. Among them, one downloads the PlugX malware.

Researchers discovered a new DOPLUGS variant with a KillSomeOne module for malware distribution, information collection, and USB-based document theft.

Unlike the previous version, it employs diverse infection methods. There are similarities with the prior DOPLUGS variant, but it has a distinctive infection approach.

Besides this, it has four components, including a malicious DLL and encrypted payload.

Earth Preta targets global government entities, especially in Asia-Pacific and Europe, using spear-phishing emails and Google Drive links. 

DOPLUGS malware is a vital tool for downloading PlugX. Besides this, a 2018 DOPLUGS variant was also discovered with KillSomeOne module integration, indicating ongoing tool improvement.

Since the Earth Preta remains active, the security teams should stay vigilant about Earth Preta’s tactics.

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are extremely harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.