General

  • Target

    5b3bfabc1a7a0ae3ffa378c4eea625cd4c77cbdc5cc9ed418f888af9be92f792

  • Size

    230KB

  • Sample

    220326-y3qdzaddcm

  • MD5

    51f607442fbf580ed8292dfcdfa5737c

  • SHA1

    d34bbbae67b70c92791662b28e7518e0b72a7727

  • SHA256

    5b3bfabc1a7a0ae3ffa378c4eea625cd4c77cbdc5cc9ed418f888af9be92f792

  • SHA512

    282ccc2afcac56077aaace23ae8ad225ae464f7db2f22d9a37372f827ca5ea58289e5792ff32aba5909c82d93a6e751dba317694722c808d4e559cb5a43a1c8c

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      5b3bfabc1a7a0ae3ffa378c4eea625cd4c77cbdc5cc9ed418f888af9be92f792

    • Size

      230KB

    • MD5

      51f607442fbf580ed8292dfcdfa5737c

    • SHA1

      d34bbbae67b70c92791662b28e7518e0b72a7727

    • SHA256

      5b3bfabc1a7a0ae3ffa378c4eea625cd4c77cbdc5cc9ed418f888af9be92f792

    • SHA512

      282ccc2afcac56077aaace23ae8ad225ae464f7db2f22d9a37372f827ca5ea58289e5792ff32aba5909c82d93a6e751dba317694722c808d4e559cb5a43a1c8c

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks