General

  • Target

    b297268489b285cb347ca9a7efc9339d36505e61bfd9b29719321e4164c8c9cf

  • Size

    713KB

  • Sample

    220118-qqdkmsbdhn

  • MD5

    a692018d2b9c401318fe8e49903c8e7f

  • SHA1

    c443761f15cd362b6aff6aa1dc17a3127e9527a6

  • SHA256

    b297268489b285cb347ca9a7efc9339d36505e61bfd9b29719321e4164c8c9cf

  • SHA512

    4be1b1a95c56cdb9e2b0e9c3ca4b235911da1c4a881f37d44ced0bc55a6a49b64244814089487c23a90a360a9f4eb57005efb2b0cdd668ef5df1afd03b0e5baa

Malware Config

Extracted

Family

systembc

C2

mainscpnl.xyz:4207

backpscpnl.xyz:4207

Targets

    • Target

      b297268489b285cb347ca9a7efc9339d36505e61bfd9b29719321e4164c8c9cf

    • Size

      713KB

    • MD5

      a692018d2b9c401318fe8e49903c8e7f

    • SHA1

      c443761f15cd362b6aff6aa1dc17a3127e9527a6

    • SHA256

      b297268489b285cb347ca9a7efc9339d36505e61bfd9b29719321e4164c8c9cf

    • SHA512

      4be1b1a95c56cdb9e2b0e9c3ca4b235911da1c4a881f37d44ced0bc55a6a49b64244814089487c23a90a360a9f4eb57005efb2b0cdd668ef5df1afd03b0e5baa

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks