General

  • Target

    ed0acb83931bb187cd2f499b5bb3cdfae3530319ad51c968e57b3506a885ba97

  • Size

    252KB

  • Sample

    220328-j78nsaddbm

  • MD5

    61a1f58f5cbd7f4ca0bbd4d60435a376

  • SHA1

    ce00e1a8efae69ba71cee648ad5a6a26ed51a43f

  • SHA256

    ed0acb83931bb187cd2f499b5bb3cdfae3530319ad51c968e57b3506a885ba97

  • SHA512

    ebff9997e9a9f9916b9ce67725e428abe4eb6f6bc6b866b84f8b53954c9dd94393c5e84a930371b40d4ca7fd1fc1e6a04d242bf45be670de46e22760af29b447

Malware Config

Extracted

Family

systembc

C2

31.44.185.6:4001

31.44.185.11:4001

Targets

    • Target

      ed0acb83931bb187cd2f499b5bb3cdfae3530319ad51c968e57b3506a885ba97

    • Size

      252KB

    • MD5

      61a1f58f5cbd7f4ca0bbd4d60435a376

    • SHA1

      ce00e1a8efae69ba71cee648ad5a6a26ed51a43f

    • SHA256

      ed0acb83931bb187cd2f499b5bb3cdfae3530319ad51c968e57b3506a885ba97

    • SHA512

      ebff9997e9a9f9916b9ce67725e428abe4eb6f6bc6b866b84f8b53954c9dd94393c5e84a930371b40d4ca7fd1fc1e6a04d242bf45be670de46e22760af29b447

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

      suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    • suricata: ET MALWARE Win32/SystemBC CnC Checkin

      suricata: ET MALWARE Win32/SystemBC CnC Checkin

    • Downloads MZ/PE file

    • Executes dropped EXE

MITRE ATT&CK Matrix

Tasks