Overview

overview

10

Static

static

8

c37e79057c...6a.exe

windows7_x64

10

c37e79057c...6a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c37e79057ccdd18492554cfb1d86d77a69667ce2a8b0841d560f12eb479f356a

  • Size

    173KB

  • Sample

    220319-hp816adea6

  • MD5

    b116459b4baffd9c1efd7153884f9d35

  • SHA1

    673fd7eb331a1c5645fa4264f85bbd722531f318

  • SHA256

    c37e79057ccdd18492554cfb1d86d77a69667ce2a8b0841d560f12eb479f356a

  • SHA512

    6f09a7b7be8a3f4519492d387e2c1441e70cc411eafb2e463ce0f0b802e9b672a60895b778a27adaa5a55d9fd35c3285a342658ca77cd1240c026efb10eea1aa

Score
10/10
systembctrojanupx

Malware Config

Extracted

Family

systembc

C2

dec15coma.com:4039

dec15coma.xyz:4039

Targets

    • Target

      c37e79057ccdd18492554cfb1d86d77a69667ce2a8b0841d560f12eb479f356a

    • Size

      173KB

    • MD5

      b116459b4baffd9c1efd7153884f9d35

    • SHA1

      673fd7eb331a1c5645fa4264f85bbd722531f318

    • SHA256

      c37e79057ccdd18492554cfb1d86d77a69667ce2a8b0841d560f12eb479f356a

    • SHA512

      6f09a7b7be8a3f4519492d387e2c1441e70cc411eafb2e463ce0f0b802e9b672a60895b778a27adaa5a55d9fd35c3285a342658ca77cd1240c026efb10eea1aa

    Score
    10/10
    systembctrojanupx

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks