systembc | e3edf5e1c47e823f99c16bf388395a3a51708f492fdd057b58b19660dc96417e | Triage

Sharing

General

Target

e3edf5e1c47e823f99c16bf388395a3a51708f492fdd057b58b19660dc96417e
Size

281KB
Sample

220419-qk92nadeh2
MD5

4492cce08449651654708c03f621ba63
SHA1

8896c08bec98a3b7f5c1b6fa8fd005586a035617
SHA256

e3edf5e1c47e823f99c16bf388395a3a51708f492fdd057b58b19660dc96417e
SHA512

e0f9c97b2959bb17de8c351fc315ed9691d5f6154907541baedb29448c70e1f57d64cdf59d6cf7408ed8f229ac123da67f2075c53188ffcf1a562735ac417899

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

sdadvert197.com:4044

mexstat128.com:4044

Targets

- Target
  
  e3edf5e1c47e823f99c16bf388395a3a51708f492fdd057b58b19660dc96417e
- Size
  
  281KB
- MD5
  
  4492cce08449651654708c03f621ba63
- SHA1
  
  8896c08bec98a3b7f5c1b6fa8fd005586a035617
- SHA256
  
  e3edf5e1c47e823f99c16bf388395a3a51708f492fdd057b58b19660dc96417e
- SHA512
  
  e0f9c97b2959bb17de8c351fc315ed9691d5f6154907541baedb29448c70e1f57d64cdf59d6cf7408ed8f229ac123da67f2075c53188ffcf1a562735ac417899
Score

10^/10

systembc trojan
- SystemBC
  SystemBC is a proxy and remote administration tool first seen in 2019.
  trojan systembc
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Connection Proxy

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Connection Proxy

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2