General

  • Target

    572caae09650d4eba511615a5747c2f0eea16fa0146657bc5e82bac131288ead

  • Size

    233KB

  • Sample

    220312-2ev64adfcm

  • MD5

    d5a1df9d234d4bb47628ca6f22b02c1a

  • SHA1

    b685e795c9505b28d43de0879ec98b9ecab0e4e2

  • SHA256

    572caae09650d4eba511615a5747c2f0eea16fa0146657bc5e82bac131288ead

  • SHA512

    3b1683269f9077b045b74c31acb6cd7e94040fee7f8024fa74a3e68d07c971859daf718b7fb36a4cb57507b6287d937251a7e1fc3307fca16d60c4c5dcd420ac

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      572caae09650d4eba511615a5747c2f0eea16fa0146657bc5e82bac131288ead

    • Size

      233KB

    • MD5

      d5a1df9d234d4bb47628ca6f22b02c1a

    • SHA1

      b685e795c9505b28d43de0879ec98b9ecab0e4e2

    • SHA256

      572caae09650d4eba511615a5747c2f0eea16fa0146657bc5e82bac131288ead

    • SHA512

      3b1683269f9077b045b74c31acb6cd7e94040fee7f8024fa74a3e68d07c971859daf718b7fb36a4cb57507b6287d937251a7e1fc3307fca16d60c4c5dcd420ac

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks