General

  • Target

    7fcee76d90a2f2280f81df3c9f84df0de6095b4e078e49a88b67fb6e19b6885e

  • Size

    233KB

  • Sample

    220313-vwmsqaaehj

  • MD5

    5af54be6a7a2934eb5a109296436a24d

  • SHA1

    fa9fbc98cedd06af2fdc5ad5020965308559ebe7

  • SHA256

    7fcee76d90a2f2280f81df3c9f84df0de6095b4e078e49a88b67fb6e19b6885e

  • SHA512

    553184cc0b0c44c76f9fb2ee2fd2e04584cc3084965c75f9f3c386fdbd5dce59fbdcff1d39dc12890017f736fbe4beed9173517bd682a17c4224da4d8aadd027

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      7fcee76d90a2f2280f81df3c9f84df0de6095b4e078e49a88b67fb6e19b6885e

    • Size

      233KB

    • MD5

      5af54be6a7a2934eb5a109296436a24d

    • SHA1

      fa9fbc98cedd06af2fdc5ad5020965308559ebe7

    • SHA256

      7fcee76d90a2f2280f81df3c9f84df0de6095b4e078e49a88b67fb6e19b6885e

    • SHA512

      553184cc0b0c44c76f9fb2ee2fd2e04584cc3084965c75f9f3c386fdbd5dce59fbdcff1d39dc12890017f736fbe4beed9173517bd682a17c4224da4d8aadd027

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks