Description
SystemBC is a proxy and remote administration tool first seen in 2019.
09a5565e828aa3da2f70b21cbc21b08b.exe
General
Target
Size
Sample
09a5565e828aa3da2f70b21cbc21b08b.exe
372KB
220521-hlrmpsafc6
Score
10 /10
MD5
SHA1
SHA256
SHA512
09a5565e828aa3da2f70b21cbc21b08b
fbdb5431f6373262c69715c1ce3b4eb691c16714
fdd7069cdc8a066739331213b2076f2ca6acd0e97070f5d1e4dbd9d1b756a35b
236897b15b20214eeb42e10a171a77cede6a7c29cc1295255c4f69c3fe53d2623fa4ebc3ae142d1fb2a28f0527d7245ecd7822f9b9a8450de1af875eacbd8a64
Malware Config
Extracted
| Family | systembc |
| C2 |
135.125.248.50:443 146.70.53.169:443 |
Targets
Target
MD5
Filesize
09a5565e828aa3da2f70b21cbc21b08b.exe
09a5565e828aa3da2f70b21cbc21b08b
372KB
Score
10/10
SHA1
SHA256
SHA512
fbdb5431f6373262c69715c1ce3b4eb691c16714
fdd7069cdc8a066739331213b2076f2ca6acd0e97070f5d1e4dbd9d1b756a35b
236897b15b20214eeb42e10a171a77cede6a7c29cc1295255c4f69c3fe53d2623fa4ebc3ae142d1fb2a28f0527d7245ecd7822f9b9a8450de1af875eacbd8a64
Tags
Signatures
-
SystemBC
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Description
Looks up country code configured in the registry, likely geofence.
TTPs
-
Deletes itself
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
TTPs
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks