Overview

overview

10

Static

static

8

d64a8cba17...15.exe

windows7_x64

10

d64a8cba17...15.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d64a8cba1785faf9616ffe7a982ab013432b23aef75bd097d4f75dbe79ad2415

  • Size

    173KB

  • Sample

    220320-gcefcahfe6

  • MD5

    cbdfe40fef7a9604064f8494f73e49bc

  • SHA1

    09bf2fcb2f8c54e752eb5a10f2b6fc66d584b43e

  • SHA256

    d64a8cba1785faf9616ffe7a982ab013432b23aef75bd097d4f75dbe79ad2415

  • SHA512

    bee9514bd26fa31ba4977c4088d584884861dba4a9e69264e95a1fc5804edde3310ddc07f762d9908cfbf8c6436a32bd4b7539ac254913b2fa97c528bf1238dd

Score
10/10
systembctrojanupx

Malware Config

Extracted

Family

systembc

C2

dec15coma.com:4039

dec15coma.xyz:4039

Targets

    • Target

      d64a8cba1785faf9616ffe7a982ab013432b23aef75bd097d4f75dbe79ad2415

    • Size

      173KB

    • MD5

      cbdfe40fef7a9604064f8494f73e49bc

    • SHA1

      09bf2fcb2f8c54e752eb5a10f2b6fc66d584b43e

    • SHA256

      d64a8cba1785faf9616ffe7a982ab013432b23aef75bd097d4f75dbe79ad2415

    • SHA512

      bee9514bd26fa31ba4977c4088d584884861dba4a9e69264e95a1fc5804edde3310ddc07f762d9908cfbf8c6436a32bd4b7539ac254913b2fa97c528bf1238dd

    Score
    10/10
    systembctrojanupx

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks