systembc | fd9cc0f0cbd78ea32d556bea65d91e77099ef712b9f57d7bfd105ff165f27d25 | Triage

Sharing

General

Target

fd9cc0f0cbd78ea32d556bea65d91e77099ef712b9f57d7bfd105ff165f27d25
Size

203KB
Sample

220419-qjlmnsdea2
MD5

3b357e5c6891ce1a4ad293a63ac75cdb
SHA1

dc4fc7e3bffa09591dfe75d76d8cdebec9e169f8
SHA256

fd9cc0f0cbd78ea32d556bea65d91e77099ef712b9f57d7bfd105ff165f27d25
SHA512

5780e9966b40756f434b67b8f5b2e46e5de24adc4e728f52783e9b8d29a027b7718748a330144e1353820af4348acdda373fb99ff1d89b7b5bfeccb03a0f8d2b

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

sdadvert197.com:4044

mexstat128.com:4044

Targets

- Target
  
  fd9cc0f0cbd78ea32d556bea65d91e77099ef712b9f57d7bfd105ff165f27d25
- Size
  
  203KB
- MD5
  
  3b357e5c6891ce1a4ad293a63ac75cdb
- SHA1
  
  dc4fc7e3bffa09591dfe75d76d8cdebec9e169f8
- SHA256
  
  fd9cc0f0cbd78ea32d556bea65d91e77099ef712b9f57d7bfd105ff165f27d25
- SHA512
  
  5780e9966b40756f434b67b8f5b2e46e5de24adc4e728f52783e9b8d29a027b7718748a330144e1353820af4348acdda373fb99ff1d89b7b5bfeccb03a0f8d2b
Score

10^/10

systembc trojan
- SystemBC
  SystemBC is a proxy and remote administration tool first seen in 2019.
  trojan systembc
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Connection Proxy

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Connection Proxy

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2