General

  • Target

    66b2d7c88954a2afe07b15d0f6093c25.exe

  • Size

    229KB

  • Sample

    220327-vsjlwsfbar

  • MD5

    66b2d7c88954a2afe07b15d0f6093c25

  • SHA1

    1d0b138eaedea0562284741f3028e3adbf3a2f79

  • SHA256

    142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971

  • SHA512

    45821a86e252d2a666b0540eec27a7212c87be5d0146d0e0e39a85b36ac297f08bef7a7defd64a6fa4e98754f829ae95a928e6cc480ab07051dfe4651b1fd061

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      66b2d7c88954a2afe07b15d0f6093c25.exe

    • Size

      229KB

    • MD5

      66b2d7c88954a2afe07b15d0f6093c25

    • SHA1

      1d0b138eaedea0562284741f3028e3adbf3a2f79

    • SHA256

      142d21e1c1d4b09bd1853f009c1e4bae0e3f4dcff9f9fe8d55e4cc5456d20971

    • SHA512

      45821a86e252d2a666b0540eec27a7212c87be5d0146d0e0e39a85b36ac297f08bef7a7defd64a6fa4e98754f829ae95a928e6cc480ab07051dfe4651b1fd061

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix

Tasks