General

  • Target

    822751ee99cf620d862fe002c367b6dbea0c2f30220a1aca05e641d11ee173ad

  • Size

    231KB

  • Sample

    220313-lgp5vsfchl

  • MD5

    b39f87eaf56ac77a323a30c70cfd5f06

  • SHA1

    5fd9f5f8c3999b217e04644235212f6a980a8a4c

  • SHA256

    822751ee99cf620d862fe002c367b6dbea0c2f30220a1aca05e641d11ee173ad

  • SHA512

    5d6385dabaeefdd3c3be1f638fd48437adab97892767e9de76f20c5711be188923a5bc498fabd01d086cbc77f2a019ac81816f1f44e290b18a37c3fadc660489

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      822751ee99cf620d862fe002c367b6dbea0c2f30220a1aca05e641d11ee173ad

    • Size

      231KB

    • MD5

      b39f87eaf56ac77a323a30c70cfd5f06

    • SHA1

      5fd9f5f8c3999b217e04644235212f6a980a8a4c

    • SHA256

      822751ee99cf620d862fe002c367b6dbea0c2f30220a1aca05e641d11ee173ad

    • SHA512

      5d6385dabaeefdd3c3be1f638fd48437adab97892767e9de76f20c5711be188923a5bc498fabd01d086cbc77f2a019ac81816f1f44e290b18a37c3fadc660489

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks