systembc | a95c29de8321dd4dc8b9676ec640e7b3[.]exe

Resubmissions

09-04-2024 15:25

240409-stwazaeb2v 10

09-04-2024 15:25

09-04-2024 15:25

09-04-2024 15:25

13-01-2023 16:48

Sharing

Copy URL

Twitter E-mail

General

Target

a95c29de8321dd4dc8b9676ec640e7b3.exe
Size

32KB
MD5

a95c29de8321dd4dc8b9676ec640e7b3
SHA1

d9ef0d8e14ddba29ab8e39779e616344440d8f75
SHA256

7616efcd937ca8fd237f3afa86aea2294844d00cd1100b75660b4925ad88924b
SHA512

d6ee8ea621bd1a0de0046773459316eec5a4f04077f90002d48f997e64758cf6fea7d80e4e7337dc95a4827233f0da937fb9228d5a15867043d097ee73da6acf
SSDEEP

768:3Ta1PsXQ0yVmQvcs27NOJtyuv09gnoJCvcror:SsXQ0yVN2gV0Gno

Score

10^/10

systembc

Malware Config

Extracted

Family

systembc

dec15coma.com:4039

dec15coma.xyz:4039

Signatures

Systembc family
systembc

Files

a95c29de8321dd4dc8b9676ec640e7b3.exe
.exe windows x86

7530baea89bb7f06c2456714a05745a0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetMessageA
GetWindowTextA
GetWindowThreadProcessId
LoadCursorA
LoadIconA
RegisterClassA
SendMessageA
ShowWindow
TranslateMessage
UpdateWindow
wsprintfA
GetClassNameA
EnumWindows
DispatchMessageA
DefWindowProcA
CreateWindowExA

kernel32

WaitForSingleObject
WriteFile
VirtualFree
VirtualProtect
CloseHandle
CopyFileA
CreateDirectoryA
CreateEventA
CreateFileA
CreateMutexA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FileTimeToSystemTime
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetEnvironmentVariableA
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
GetVolumeInformationA
LocalAlloc
LocalFree
OpenMutexA
OpenProcess
RemoveDirectoryA
VirtualAlloc
SetFilePointer
Sleep
SystemTimeToFileTime
SetEvent

advapi32

CryptAcquireContextA
CryptExportKey
CryptImportKey
CryptReleaseContext
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
CryptDestroyKey

wsock32

htons
inet_addr
inet_ntoa
ioctlsocket
recv
select
send
setsockopt
shutdown
socket
connect
closesocket
WSAStartup
WSACleanup

shell32

CommandLineToArgvW

ws2_32

freeaddrinfo
WSAIoctl
getaddrinfo

ole32

CoUninitialize
CoInitialize
CoCreateInstance

secur32

GetUserNameExA
AcquireCredentialsHandleA
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
QueryContextAttributesA
GetUserNameExW
InitSecurityInterfaceA
InitializeSecurityContextA

crypt32

CryptStringToBinaryA
CryptDecodeObject

psapi

GetModuleFileNameExA

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 690B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

Files

7530baea89bb7f06c2456714a05745a0

Headers

File Characteristics

Imports

user32

kernel32

advapi32

wsock32

shell32

ws2_32

ole32

secur32

crypt32

psapi

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 690B

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 690B