General

  • Target

    adb4b3905162013e327b67bbeea18e1473aafb6b00a403634bd10cf8b1770929

  • Size

    273KB

  • Sample

    220327-n9q9qsdbgp

  • MD5

    d9a7e822d38ef4624cb6c6d6c058bc30

  • SHA1

    3f48b9031f653d55eb5c53a8c99346b0d4f1bd52

  • SHA256

    adb4b3905162013e327b67bbeea18e1473aafb6b00a403634bd10cf8b1770929

  • SHA512

    3084f7c27a5b453b8def1c7e8fd0f68ddcc408e57207635192451b92d0885e9ef3fafbb6c20491359a4da8cb06b35b446c11d70fa1fe0185d92d963eed5e9c5f

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      adb4b3905162013e327b67bbeea18e1473aafb6b00a403634bd10cf8b1770929

    • Size

      273KB

    • MD5

      d9a7e822d38ef4624cb6c6d6c058bc30

    • SHA1

      3f48b9031f653d55eb5c53a8c99346b0d4f1bd52

    • SHA256

      adb4b3905162013e327b67bbeea18e1473aafb6b00a403634bd10cf8b1770929

    • SHA512

      3084f7c27a5b453b8def1c7e8fd0f68ddcc408e57207635192451b92d0885e9ef3fafbb6c20491359a4da8cb06b35b446c11d70fa1fe0185d92d963eed5e9c5f

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks