General
-
Target
0eec212a21b588ae10cc4e1f55c4dddc4e652e47062b46ee8c51a154bc895b15
-
Size
87KB
-
Sample
220427-wh338abgbr
-
MD5
0314c338de096680748e36513fa6385f
-
SHA1
b73d4dfc157e69d6d8a90d1d5cfa1a34453f73c1
-
SHA256
0eec212a21b588ae10cc4e1f55c4dddc4e652e47062b46ee8c51a154bc895b15
-
SHA512
8000e73b976cc6d23aa5015f401fda8f3eee5768c4d79c4715ecff9644cf183a17248f85b2b65379c9a62aa4a388ab23b15e6765043563bdb9f63c2ffcfee5f6
Static task
static1
Behavioral task
behavioral1
Sample
0eec212a21b588ae10cc4e1f55c4dddc4e652e47062b46ee8c51a154bc895b15.exe
Resource
win7-20220414-en
Malware Config
Extracted
systembc
advertrex20.xyz:4044
gentexman37.xyz:4044
Targets
-
-
Target
0eec212a21b588ae10cc4e1f55c4dddc4e652e47062b46ee8c51a154bc895b15
-
Size
87KB
-
MD5
0314c338de096680748e36513fa6385f
-
SHA1
b73d4dfc157e69d6d8a90d1d5cfa1a34453f73c1
-
SHA256
0eec212a21b588ae10cc4e1f55c4dddc4e652e47062b46ee8c51a154bc895b15
-
SHA512
8000e73b976cc6d23aa5015f401fda8f3eee5768c4d79c4715ecff9644cf183a17248f85b2b65379c9a62aa4a388ab23b15e6765043563bdb9f63c2ffcfee5f6
-
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Tor communications
Malware can proxy its traffic through Tor for more anonymity.
-