General

  • Target

    f3c082552af86532b5df3ae3fb36c7eb9c96a617ce4b665429eaa62e40ad7984

  • Size

    231KB

  • Sample

    220327-kbvmqabfgq

  • MD5

    dc7c7aa1d408e4c6aecf7b76c1d0ed99

  • SHA1

    8140b207adad980b61a7eadd77766f08124ed21a

  • SHA256

    f3c082552af86532b5df3ae3fb36c7eb9c96a617ce4b665429eaa62e40ad7984

  • SHA512

    1e9dfcccef11d86564be1bcd20466c87b182845523d8649667d42101fd5798c86a882b99b2562fb6f0258cb2119493ceceadde8dd39d612e5c08ed6d102da2ca

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      f3c082552af86532b5df3ae3fb36c7eb9c96a617ce4b665429eaa62e40ad7984

    • Size

      231KB

    • MD5

      dc7c7aa1d408e4c6aecf7b76c1d0ed99

    • SHA1

      8140b207adad980b61a7eadd77766f08124ed21a

    • SHA256

      f3c082552af86532b5df3ae3fb36c7eb9c96a617ce4b665429eaa62e40ad7984

    • SHA512

      1e9dfcccef11d86564be1bcd20466c87b182845523d8649667d42101fd5798c86a882b99b2562fb6f0258cb2119493ceceadde8dd39d612e5c08ed6d102da2ca

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks