General

  • Target

    1e31a6de957adb7a23e155ef8e9f80e67dc763443053e0014fba9e91f4eebc6f

  • Size

    223KB

  • Sample

    220326-schnjsaegk

  • MD5

    503506554b1cfa84d2301e262beeb1f2

  • SHA1

    7e6ce1ed06bd5962fdde1bebda495d9ecc9b72a9

  • SHA256

    1e31a6de957adb7a23e155ef8e9f80e67dc763443053e0014fba9e91f4eebc6f

  • SHA512

    bf0d9dd29b62a7ec306349a25e0eae234f060a00c81bb16bee04217c9254e66b5de6a9d0b908c8e3fca696b70350066a1e03d6cb0d9250456d005d58b23ddb01

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      1e31a6de957adb7a23e155ef8e9f80e67dc763443053e0014fba9e91f4eebc6f

    • Size

      223KB

    • MD5

      503506554b1cfa84d2301e262beeb1f2

    • SHA1

      7e6ce1ed06bd5962fdde1bebda495d9ecc9b72a9

    • SHA256

      1e31a6de957adb7a23e155ef8e9f80e67dc763443053e0014fba9e91f4eebc6f

    • SHA512

      bf0d9dd29b62a7ec306349a25e0eae234f060a00c81bb16bee04217c9254e66b5de6a9d0b908c8e3fca696b70350066a1e03d6cb0d9250456d005d58b23ddb01

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks