Overview

overview

10

Static

static

d85ab3d3cf...e3.exe

windows7_x64

10

d85ab3d3cf...e3.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d85ab3d3cf815d9c394637a02a4734e4846070aaf06f2782e48f280320ba72e3

  • Size

    324KB

  • Sample

    220419-qzse6aaghm

  • MD5

    3afa02783f10e03cc1c21f33a8cf682c

  • SHA1

    f52336335dbd0688250cb163228b853af18a9db1

  • SHA256

    d85ab3d3cf815d9c394637a02a4734e4846070aaf06f2782e48f280320ba72e3

  • SHA512

    51dffad9970969e2e6c2036307d09c9985799aee049534766c43c0a0856b36c9c1412b6f07884ea859aaf9423d19ca638b4bec9dc905716a2a4f044de9d26222

Score
10/10
systembctrojan

Malware Config

Extracted

Family

systembc

C2

23hfdne.com:4035

23hfdne.xyz:4035

Targets

    • Target

      d85ab3d3cf815d9c394637a02a4734e4846070aaf06f2782e48f280320ba72e3

    • Size

      324KB

    • MD5

      3afa02783f10e03cc1c21f33a8cf682c

    • SHA1

      f52336335dbd0688250cb163228b853af18a9db1

    • SHA256

      d85ab3d3cf815d9c394637a02a4734e4846070aaf06f2782e48f280320ba72e3

    • SHA512

      51dffad9970969e2e6c2036307d09c9985799aee049534766c43c0a0856b36c9c1412b6f07884ea859aaf9423d19ca638b4bec9dc905716a2a4f044de9d26222

    Score
    10/10
    systembctrojan

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks