General

  • Target

    26babc0a6d078f137e389a7ea1c4a8a7110c495c053269d52a7936469df06073

  • Size

    233KB

  • Sample

    220313-xvd6asbfgk

  • MD5

    46b2756fe95bbb5020b18f97392e2132

  • SHA1

    2ea2c500bde740012c5f7623107edff40ae9c60f

  • SHA256

    26babc0a6d078f137e389a7ea1c4a8a7110c495c053269d52a7936469df06073

  • SHA512

    4bdf30aa2160707160ef30f1c9449ff7fd0d489b21d46812f2a3982d728364db48e9809ca31986f54d7add6b560c9447ad6d6c6dbaba0d4a1b65859b8827cacc

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      26babc0a6d078f137e389a7ea1c4a8a7110c495c053269d52a7936469df06073

    • Size

      233KB

    • MD5

      46b2756fe95bbb5020b18f97392e2132

    • SHA1

      2ea2c500bde740012c5f7623107edff40ae9c60f

    • SHA256

      26babc0a6d078f137e389a7ea1c4a8a7110c495c053269d52a7936469df06073

    • SHA512

      4bdf30aa2160707160ef30f1c9449ff7fd0d489b21d46812f2a3982d728364db48e9809ca31986f54d7add6b560c9447ad6d6c6dbaba0d4a1b65859b8827cacc

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks