General

  • Target

    f19acc5921ede6163dd6394d2d749aa3c73176e731c23605648a3d76f12f6e55

  • Size

    232KB

  • Sample

    220313-ekqr8sedcp

  • MD5

    2c8563b5b272972a73a03ec077fc7b81

  • SHA1

    a2e6faa70c701789c3413dff7ba6456f03a7ec1a

  • SHA256

    f19acc5921ede6163dd6394d2d749aa3c73176e731c23605648a3d76f12f6e55

  • SHA512

    33546ef3c4d63722bf954c24fc4fd5aa0f7cf408736dd03df43b4a8629f8a68e5058d2cb3921e6426fa96997a3be96097520cf37842fb34bb0bffb0f0ed044d2

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      f19acc5921ede6163dd6394d2d749aa3c73176e731c23605648a3d76f12f6e55

    • Size

      232KB

    • MD5

      2c8563b5b272972a73a03ec077fc7b81

    • SHA1

      a2e6faa70c701789c3413dff7ba6456f03a7ec1a

    • SHA256

      f19acc5921ede6163dd6394d2d749aa3c73176e731c23605648a3d76f12f6e55

    • SHA512

      33546ef3c4d63722bf954c24fc4fd5aa0f7cf408736dd03df43b4a8629f8a68e5058d2cb3921e6426fa96997a3be96097520cf37842fb34bb0bffb0f0ed044d2

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks