General

  • Target

    70f95be0a7035dd24ec29d91f3bf9db0d184760725f4742d2560e59d048221ea

  • Size

    232KB

  • Sample

    220313-nl92yagfcr

  • MD5

    f8e7ddc24c5807eefb4c3a1d984c9649

  • SHA1

    549870c8f3cc21b13bb78969ce6e8a1717c3255a

  • SHA256

    70f95be0a7035dd24ec29d91f3bf9db0d184760725f4742d2560e59d048221ea

  • SHA512

    bc5207ad0a9c5602eb401e38d92fbcf51f8fe90dd73ac27e33c1d71ae99b4ef34eb95a29093b5ce2b88377c367d0c189ed1e8a8c0176d7496d61ee940d9b392d

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      70f95be0a7035dd24ec29d91f3bf9db0d184760725f4742d2560e59d048221ea

    • Size

      232KB

    • MD5

      f8e7ddc24c5807eefb4c3a1d984c9649

    • SHA1

      549870c8f3cc21b13bb78969ce6e8a1717c3255a

    • SHA256

      70f95be0a7035dd24ec29d91f3bf9db0d184760725f4742d2560e59d048221ea

    • SHA512

      bc5207ad0a9c5602eb401e38d92fbcf51f8fe90dd73ac27e33c1d71ae99b4ef34eb95a29093b5ce2b88377c367d0c189ed1e8a8c0176d7496d61ee940d9b392d

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks