General

  • Target

    a2298b4616ca79274e48d04f2c886b1448495523309779e0acb011197d99b2ce

  • Size

    252KB

  • Sample

    220328-dvebhscahk

  • MD5

    1f1d2d38f50254949ba853cdf0915ae8

  • SHA1

    d605a9773a50059e0b8948a4f30b5a8fa58fb404

  • SHA256

    a2298b4616ca79274e48d04f2c886b1448495523309779e0acb011197d99b2ce

  • SHA512

    83faaa5f27ce44e799d93183a42ea9de851bd336e92617598d1683b771b18959dbb0be62730d2b4c9d3999d27470e8fbefe011d9b05831774e6b29957303165d

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      a2298b4616ca79274e48d04f2c886b1448495523309779e0acb011197d99b2ce

    • Size

      252KB

    • MD5

      1f1d2d38f50254949ba853cdf0915ae8

    • SHA1

      d605a9773a50059e0b8948a4f30b5a8fa58fb404

    • SHA256

      a2298b4616ca79274e48d04f2c886b1448495523309779e0acb011197d99b2ce

    • SHA512

      83faaa5f27ce44e799d93183a42ea9de851bd336e92617598d1683b771b18959dbb0be62730d2b4c9d3999d27470e8fbefe011d9b05831774e6b29957303165d

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks