Killsomeone

KillSomeOne is a highly potent malware that has been integrated with various variants of the PlugX malware, a notorious backdoor Trojan. The first variant of this integration was discovered in 2018, as part of a DOPLUGS variant, which showcased the KillSomeOne module's capabilities. This malware operates by infecting systems through suspicious downloads, emails, or websites and can cause significant damage by stealing personal information, disrupting operations, or holding data for ransom. An interesting feature of the KillSomeOne + Hodur variant is its use of two types of C&C servers: one for receiving backdoor commands and another for downloading payloads for process injection in svchost.exe. The KillSomeOne module has undergone several stages of evolution, each time integrating with different types of PlugX malware. These integrations have resulted in an array of variants, each more sophisticated than the last. One such example is the first PlugX variant featuring the KillSomeOne module designed specifically for spreading via USB, as mentioned in Avira’s report. Moreover, the module specializes in USB infections, indicating a unique propagation method compared to other malware. In terms of behavior, the KillSomeOne thread exhibits two major traits. Firstly, it removes all traces related to previous instances of PlugX malware, including files, processes, registries, and scheduled tasks. This behavior indicates a high level of sophistication and stealth, enabling the malware to evade detection and removal. Furthermore, continuous hunting efforts have revealed several customized PlugX malware samples equipped with the KillSomeOne module, suggesting that this dangerous combination continues to evolve and pose threats to cybersecurity.