General

  • Target

    1084219642d497a177c7a02c9c31b193.exe

  • Size

    230KB

  • Sample

    220327-vsjlwsfban

  • MD5

    1084219642d497a177c7a02c9c31b193

  • SHA1

    d98644be834e7d3d12346956986f40fb6f50cdf9

  • SHA256

    7861180570ecfb48fccc3e1cff748974c64e58c31530aee4f9243af810200cc3

  • SHA512

    a9e47b2fc6c67ce395adf4f74d4eeb0ecd6ebe79062b61625acb95b6ce7fce0f95adb0b10985ade965c61190564c2a2345be119c3c5c4a6bd99e346495dd82bb

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      1084219642d497a177c7a02c9c31b193.exe

    • Size

      230KB

    • MD5

      1084219642d497a177c7a02c9c31b193

    • SHA1

      d98644be834e7d3d12346956986f40fb6f50cdf9

    • SHA256

      7861180570ecfb48fccc3e1cff748974c64e58c31530aee4f9243af810200cc3

    • SHA512

      a9e47b2fc6c67ce395adf4f74d4eeb0ecd6ebe79062b61625acb95b6ce7fce0f95adb0b10985ade965c61190564c2a2345be119c3c5c4a6bd99e346495dd82bb

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks