BKDR_PLUGX.AQT

Posted: April 26, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	14,725
Threat Level:	2/10
Infected PCs:	10,354

First Seen:	April 26, 2013
Last Seen:	September 4, 2023
OS(es) Affected:	Windows

BKDR_PLUGX.AQT is a member of the PlugX family of backdoor Trojans, a group of Trojans related to e-mail-based PoisonIvy attack campaigns in Asia. Along with some traditional backdoor features that allow criminals to compromise your computer easily, BKDR_PLUGX.AQT is structured in such a way as to force legitimate McAfee software to load BKDR_PLUGX.AQT automatically – a malicious DLL-loading tactic that's a hallmark of the PlugX family. Because BKDR_PLUGX.AQT is well-disguised as a component of a legitimate program, SpywareRemove.com malware experts suggest using anti-malware products to detect BKDR_PLUGX.AQT, which is likely to be accompanied by other PC threats. Naturally, deleting BKDR_PLUGX.AQT can proceed after its detection, and you should do it as quick as possible.

BKDR_PLUGX.AQT: Plugging into Your PC's Legit Software to Hide

BKDR_PLUGX.AQT is just one of many variants of PlugX backdoor Trojans, with other members including Troj/Plugx-G, BKDR_PLUGX.BUT, BKDR_PLUGX.SME, BKDR_PLUGX.DMI and BKDR_PLUGX.AI. Like the other recent variants of PlugX, BKDR_PLUGX.AQT is designed to be loaded as a malicious DLL component for a completely unrelated and benign application. Previous applications abused in this manner include Microsoft help files and Lenovo-brand software, but BKDR_PLUGX.AQT prefers to disguise itself as part of a McAfee-brand anti-malware product. BKDR_PLUGX.AQT's file name imitates the structure of the McAfee program that loads BKDR_PLUGX.AQT, making it seem like BKDR_PLUGX.AQT is an entirely benevolent component of that program – at least, to casual inspection.

BKDR_PLUGX.AQT then loads a second malicious component that's also detected as BKDR_PLUGX.AQT, and is mislabeled as an URL, presumably to throw off anti-malware programs. This allows BKDR_PLUGX.AQT to contact its C&C server, from which BKDR_PLUGX.AQT may:

Download other forms of malicious software, most particularly, the Poison Ivy RAT.
Upload any information that's stolen from your computer, such as passwords or system details.
Receive further instructions on how to alter your PC with respect to its security and privacy settings.

This backdoor connection is, SpywareRemove.com malware researchers warn, entirely contained within the McAfee program's memory process, which can hinder any attempted detection by both manual and automated methods.

Unplugging BKDR_PLUGX.AQT from Your Application

BKDR_PLUGX.AQT does include some fairly well-developed defenses against being detected, but its main purpose appears to be to install more specialized PC threats than itself, such as the Poison Ivy RAT. BKDR_PLUGX.AQT attacks, like all PlugX attacks, are initiated mainly via e-mail spam messages that include Trojan droppers for BKDR_PLUGX.AQT as file attachments. SpywareRemove.com malware experts recommend scanning unusual e-mail downloads on a habitual basis, which should allow you to detect and delete Trojans related to BKDR_PLUGX.AQT attacks before your PC can be compromised.

Appropriate anti-malware applications should be able to remove BKDR_PLUGX.AQT and any other PC threats associated with BKDR_PLUGX.AQT. However, in light of the DLL-loading strategies used by the PlugX family, SpywareRemove.com malware researchers most warn victims to avoid trying to remove BKDR_PLUGX.AQT while the program that loads BKDR_PLUGX.AQT's DLL file is open.
BKDR_PLUGX.AQT and other members of the PlugX family are of particular concern to Asia, with nations such as China, Taiwan and Japan under concerted attack from this family.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

Mc.exe

File name: Mc.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

McUtil.dll

File name: McUtil.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file

McUtil.dll.url

File name: McUtil.dll.url
Mime Type: unknown/url
Group: Malware file

Additional Information

The following URL's were detected:

publicconfirm.com