systembc | d0d3a4d35f46f3a7ed5ef913b46afdcf80e2ed2a226a20cbec81115454f27dd3 | Triage

Sharing

General

Target

d0d3a4d35f46f3a7ed5ef913b46afdcf80e2ed2a226a20cbec81115454f27dd3
Size

168KB
Sample

220418-ftlejsbbaq
MD5

2d8166616d74027c23e29f30b41922cb
SHA1

7ab3a4dd77bb7716bf3d7c106e447108796a70b6
SHA256

d0d3a4d35f46f3a7ed5ef913b46afdcf80e2ed2a226a20cbec81115454f27dd3
SHA512

24cfe8f631a2643b4d166bcf41b79839f71df9a1bd52563742c5fb917d4d130f2784848e750b70d1e441e17339b9914ee5dbdd33417a7bab5caae83b0001ec27

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

26asdcgd.com:4039

26asdcgd.xyz:4039

Targets

- Target
  
  d0d3a4d35f46f3a7ed5ef913b46afdcf80e2ed2a226a20cbec81115454f27dd3
- Size
  
  168KB
- MD5
  
  2d8166616d74027c23e29f30b41922cb
- SHA1
  
  7ab3a4dd77bb7716bf3d7c106e447108796a70b6
- SHA256
  
  d0d3a4d35f46f3a7ed5ef913b46afdcf80e2ed2a226a20cbec81115454f27dd3
- SHA512
  
  24cfe8f631a2643b4d166bcf41b79839f71df9a1bd52563742c5fb917d4d130f2784848e750b70d1e441e17339b9914ee5dbdd33417a7bab5caae83b0001ec27
Score

10^/10

systembc trojan
- SystemBC
  SystemBC is a proxy and remote administration tool first seen in 2019.
  trojan systembc
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Connection Proxy

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Connection Proxy

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2