Overview

overview

10

Static

static

d7588ed746...45.exe

windows7_x64

10

d7588ed746...45.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045

  • Size

    178KB

  • Sample

    220512-ntynwafhcl

  • MD5

    8a53ca14784db0d61dee57dbd1c38e54

  • SHA1

    a60f41f04529432ae8e4577ba9f13bca904ab4e9

  • SHA256

    d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045

  • SHA512

    3947f8df002b02e7d5ee9df07d1fd93e7f8bf322d91f99a4069480498d61b3f42718790d7ec93100a29257339d1f9e2d61e0a98740b5a05fa5e994c280b868d8

Score
10/10
systembcsuricatatrojan

Malware Config

Extracted

Family

systembc

C2

sdadvert197.com:4044

mexstat128.com:4044

Targets

    • Target

      d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045

    • Size

      178KB

    • MD5

      8a53ca14784db0d61dee57dbd1c38e54

    • SHA1

      a60f41f04529432ae8e4577ba9f13bca904ab4e9

    • SHA256

      d7588ed746eb3b1ef4b5ac9507d8e432174eba3b4638df6e1497ed45caecd045

    • SHA512

      3947f8df002b02e7d5ee9df07d1fd93e7f8bf322d91f99a4069480498d61b3f42718790d7ec93100a29257339d1f9e2d61e0a98740b5a05fa5e994c280b868d8

    Score
    10/10
    systembcsuricatatrojan

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query

      suricata: ET MALWARE Observed SystemBC CnC Domain in DNS Query

      suricata

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

1
T1090

Impact

Tasks