Overview

overview

10

Static

static

8

bbd8d78a0c...bd.exe

windows7_x64

10

bbd8d78a0c...bd.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bbd8d78a0c241948acda56a12e92efcbeaff2b89443c33135113ccd508e646bd

  • Size

    234KB

  • Sample

    220319-mz6e8sgcb3

  • MD5

    f36c144d3572825d5a4bbe01fc6b2e5f

  • SHA1

    13c0276832e96446fc927cf77b057194a7326cc6

  • SHA256

    bbd8d78a0c241948acda56a12e92efcbeaff2b89443c33135113ccd508e646bd

  • SHA512

    666346ee29abf0caa8314226c421a2ca358d8239ecc59c8e7b5ebe8fdeb2ccb0fab39f528c5bd0042d47dfcf2061e99c36363b10ef905e48f4ad129574ca7181

Score
10/10
systembctrojanupx

Malware Config

Extracted

Family

systembc

C2

dec15coma.com:4039

dec15coma.xyz:4039

Targets

    • Target

      bbd8d78a0c241948acda56a12e92efcbeaff2b89443c33135113ccd508e646bd

    • Size

      234KB

    • MD5

      f36c144d3572825d5a4bbe01fc6b2e5f

    • SHA1

      13c0276832e96446fc927cf77b057194a7326cc6

    • SHA256

      bbd8d78a0c241948acda56a12e92efcbeaff2b89443c33135113ccd508e646bd

    • SHA512

      666346ee29abf0caa8314226c421a2ca358d8239ecc59c8e7b5ebe8fdeb2ccb0fab39f528c5bd0042d47dfcf2061e99c36363b10ef905e48f4ad129574ca7181

    Score
    10/10
    systembctrojanupx

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks