systembc | 3f97d3a159c05ed13798178c697514769201a1484922b09fdd7d8e00517aa861[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3f97d3a159c05ed13798178c697514769201a1484922b09fdd7d8e00517aa861.exe
Size

32KB
MD5

8b4486ad760aabc58c411c83bf922fd7
SHA1

540cd841f100a79e60fa221d3e4383b81289c546
SHA256

3f97d3a159c05ed13798178c697514769201a1484922b09fdd7d8e00517aa861
SHA512

9b7c2d59c2436f6304c7d8216ac34a5bd845125b717470a62bcb8532dc677dd41fa8bf5c414afdb37c7ac10d0ba4ad05b95f8263c87bf20462b649566ed43432
SSDEEP

768:HqPzUdiJ8dayafVcCSWYVYnPrryFbnpoJo2TZKc6VFg:YLJ8dayaaupDobnpo2wZJ

Score

10^/10

systembc

Malware Config

Extracted

Family

systembc

146.70.101.95:4001

Signatures

Systembc family
systembc

Files

3f97d3a159c05ed13798178c697514769201a1484922b09fdd7d8e00517aa861.exe
.exe windows x86

bf0c7df0c054c291d79bd1c72984352c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CreateWindowExA
GetWindowThreadProcessId
LoadCursorA
LoadIconA
RegisterClassA
SendMessageA
ShowWindow
TranslateMessage
UpdateWindow
GetWindowTextA
GetMessageA
GetClassNameA
EnumWindows
DispatchMessageA
DefWindowProcA
wsprintfA

kernel32

WaitForSingleObject
WriteFile
VirtualProtect
VirtualFree
CloseHandle
CopyFileA
CreateDirectoryA
CreateEventA
CreateFileA
CreateMutexA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FileTimeToSystemTime
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetEnvironmentVariableA
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
GetVolumeInformationA
LocalAlloc
LocalFree
OpenMutexA
OpenProcess
RemoveDirectoryA
SetEvent
VirtualAlloc
Sleep
SystemTimeToFileTime
SetFilePointer

advapi32

CryptExportKey
CryptDestroyKey
CryptAcquireContextA
CryptReleaseContext
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
CryptImportKey

wsock32

htons
inet_addr
inet_ntoa
ioctlsocket
select
send
setsockopt
shutdown
socket
recv
connect
closesocket
WSAStartup
WSACleanup

shell32

CommandLineToArgvW

ws2_32

WSAIoctl
getaddrinfo
freeaddrinfo

ole32

CoCreateInstance
CoUninitialize
CoInitialize

netapi32

NetGetJoinInformation

secur32

GetUserNameExW
InitializeSecurityContextA
AcquireCredentialsHandleA
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
GetUserNameExA
QueryContextAttributesA
InitSecurityInterfaceA

crypt32

CryptStringToBinaryA
CryptDecodeObject

psapi

GetModuleFileNameExA

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

bf0c7df0c054c291d79bd1c72984352c

Headers

File Characteristics

Imports

user32

kernel32

advapi32

wsock32

shell32

ws2_32

ole32

netapi32

secur32

crypt32

psapi

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 692B

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 692B