General
-
Target
b93187507fed6a52f34bac3af0675b88f672b2e7328dcb983434789050d74825
-
Size
121KB
-
Sample
220502-c19tyafacr
-
MD5
e60119dd588f168109ae6d25a187202d
-
SHA1
0b3cde408aa8eea80fbf9a8868a6cd194dc2b022
-
SHA256
b93187507fed6a52f34bac3af0675b88f672b2e7328dcb983434789050d74825
-
SHA512
731ed02e9cb967bca1cddf93251ee607d499912df7dfbdf6720faa7339ea25674828d846052852b95bd4f4e8f1a7e287aa2883addd4eb6f1aaf75b13f59b9eac
Static task
static1
Behavioral task
behavioral1
Sample
b93187507fed6a52f34bac3af0675b88f672b2e7328dcb983434789050d74825.exe
Resource
win7-20220414-en
Malware Config
Extracted
systembc
sdadvert197.com:4044
mexstat128.com:4044
Targets
-
-
Target
b93187507fed6a52f34bac3af0675b88f672b2e7328dcb983434789050d74825
-
Size
121KB
-
MD5
e60119dd588f168109ae6d25a187202d
-
SHA1
0b3cde408aa8eea80fbf9a8868a6cd194dc2b022
-
SHA256
b93187507fed6a52f34bac3af0675b88f672b2e7328dcb983434789050d74825
-
SHA512
731ed02e9cb967bca1cddf93251ee607d499912df7dfbdf6720faa7339ea25674828d846052852b95bd4f4e8f1a7e287aa2883addd4eb6f1aaf75b13f59b9eac
-
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Tor communications
Malware can proxy its traffic through Tor for more anonymity.
-