General

  • Target

    e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb

  • Size

    233KB

  • Sample

    220313-sxj24shhfr

  • MD5

    3530e329fdce8e9c8aae9581f050ffdb

  • SHA1

    a076de97dfa81e06c9c3beef8f09d4803249528c

  • SHA256

    e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb

  • SHA512

    77a1ed7abe3c22b36db7cc35f301404362076c556bab06f891279c1c4ee756e4fdc3ed3d03d284af8055dd7c52f93fec291eab74e650cf1d8c5670ef737b82d1

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb

    • Size

      233KB

    • MD5

      3530e329fdce8e9c8aae9581f050ffdb

    • SHA1

      a076de97dfa81e06c9c3beef8f09d4803249528c

    • SHA256

      e9a9073f51b5b6414d63506686d03f7dd0f66b614d198bb631c62892d617d5fb

    • SHA512

      77a1ed7abe3c22b36db7cc35f301404362076c556bab06f891279c1c4ee756e4fdc3ed3d03d284af8055dd7c52f93fec291eab74e650cf1d8c5670ef737b82d1

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks