General

  • Target

    dbf1a40d9c78fde45c5c1f1648af8b3592e3ef4fea2f5c086b196d3784fdc3c8

  • Size

    232KB

  • Sample

    220313-s93pzsaadr

  • MD5

    14b1292f0bb166062b889b5ea588d593

  • SHA1

    66522b2905ca9d04a9f3531bb1b73a7e0763de59

  • SHA256

    dbf1a40d9c78fde45c5c1f1648af8b3592e3ef4fea2f5c086b196d3784fdc3c8

  • SHA512

    0677383a45970bd7189e8158ffda4d1fd3076b61e5566efb46ba108bf1b5317d449f93d149ad09b28e4ee08ec90678fbcfc2dbcb8bc09a2ef4bbd866e31d595b

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      dbf1a40d9c78fde45c5c1f1648af8b3592e3ef4fea2f5c086b196d3784fdc3c8

    • Size

      232KB

    • MD5

      14b1292f0bb166062b889b5ea588d593

    • SHA1

      66522b2905ca9d04a9f3531bb1b73a7e0763de59

    • SHA256

      dbf1a40d9c78fde45c5c1f1648af8b3592e3ef4fea2f5c086b196d3784fdc3c8

    • SHA512

      0677383a45970bd7189e8158ffda4d1fd3076b61e5566efb46ba108bf1b5317d449f93d149ad09b28e4ee08ec90678fbcfc2dbcb8bc09a2ef4bbd866e31d595b

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks