General
-
Target
6d952c5c8a586f51361a500fe63fdaa3432060987f6c3682c6510a716331cd2c
-
Size
316KB
-
Sample
220508-gmwsdabffn
-
MD5
afbea4a6f073cac89a9f3cd6df0844a3
-
SHA1
3517690fa2065239a6ad49abcf7153248d02cbf0
-
SHA256
6d952c5c8a586f51361a500fe63fdaa3432060987f6c3682c6510a716331cd2c
-
SHA512
3bedf050bbc9ac1ceb059e30efa590fc2db85ef1f0961d36b8f443166ece56a8895755fe5bcbacf6a7a8a3928708b28a9885375ae28b97d9363fc8d90d99c99d
Static task
static1
Behavioral task
behavioral1
Sample
6d952c5c8a586f51361a500fe63fdaa3432060987f6c3682c6510a716331cd2c.exe
Resource
win7-20220414-en
Malware Config
Extracted
systembc
sdadvert197.com:4044
mexstat128.com:4044
Targets
-
-
Target
6d952c5c8a586f51361a500fe63fdaa3432060987f6c3682c6510a716331cd2c
-
Size
316KB
-
MD5
afbea4a6f073cac89a9f3cd6df0844a3
-
SHA1
3517690fa2065239a6ad49abcf7153248d02cbf0
-
SHA256
6d952c5c8a586f51361a500fe63fdaa3432060987f6c3682c6510a716331cd2c
-
SHA512
3bedf050bbc9ac1ceb059e30efa590fc2db85ef1f0961d36b8f443166ece56a8895755fe5bcbacf6a7a8a3928708b28a9885375ae28b97d9363fc8d90d99c99d
-
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses Tor communications
Malware can proxy its traffic through Tor for more anonymity.
-