General

  • Target

    519e4c270cc4c94c04ed38fbf5753477c811c260723f032ddec5e04e91eef266

  • Size

    232KB

  • Sample

    220313-r11ctshgfl

  • MD5

    29d27fcaacf725fa80f15793dc3c5214

  • SHA1

    1ea0a2f54f7b2eb3f7091f5dc5ca91382715c058

  • SHA256

    519e4c270cc4c94c04ed38fbf5753477c811c260723f032ddec5e04e91eef266

  • SHA512

    433fcffbe41469cca583badc16878e9001af4b8ea2ed35525f6af024c9597d521dd658e8579525b42b4b240486074e5d7849758337489fed64fb3a0104c73421

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      519e4c270cc4c94c04ed38fbf5753477c811c260723f032ddec5e04e91eef266

    • Size

      232KB

    • MD5

      29d27fcaacf725fa80f15793dc3c5214

    • SHA1

      1ea0a2f54f7b2eb3f7091f5dc5ca91382715c058

    • SHA256

      519e4c270cc4c94c04ed38fbf5753477c811c260723f032ddec5e04e91eef266

    • SHA512

      433fcffbe41469cca583badc16878e9001af4b8ea2ed35525f6af024c9597d521dd658e8579525b42b4b240486074e5d7849758337489fed64fb3a0104c73421

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks