systembc | a809d7c791aa2a091554cae7ec1ef8321a2a818c134ec81fb2b53ca2cff7aa34 | Triage

Sharing

General

Target

d87be573a26e97c5b4b8959aab27d931.exe
Size

167KB
Sample

230218-jmmktabc72
MD5

d87be573a26e97c5b4b8959aab27d931
SHA1

0953751d891c051e74bbbb974edc89a29fa88e7e
SHA256

a809d7c791aa2a091554cae7ec1ef8321a2a818c134ec81fb2b53ca2cff7aa34
SHA512

1fa16cbc837b18dce29113ba13301ba48352120e3e16ce660d52bc3bb9fb79c204772e1b31eccd4d684f33aaee22a9a5d68df8682838660bb5a88030b09ac307
SSDEEP

3072:O0O9ibCRpHnL972hGbVl2nES48tezHem:XwlRpHLl2vESMim

Score

10^/10

systembc trojan

Malware Config

Extracted

Family

systembc

C2

advert127ds.xyz:4044

adxspace147.xyz:4044

Targets

- Target
  
  d87be573a26e97c5b4b8959aab27d931.exe
- Size
  
  167KB
- MD5
  
  d87be573a26e97c5b4b8959aab27d931
- SHA1
  
  0953751d891c051e74bbbb974edc89a29fa88e7e
- SHA256
  
  a809d7c791aa2a091554cae7ec1ef8321a2a818c134ec81fb2b53ca2cff7aa34
- SHA512
  
  1fa16cbc837b18dce29113ba13301ba48352120e3e16ce660d52bc3bb9fb79c204772e1b31eccd4d684f33aaee22a9a5d68df8682838660bb5a88030b09ac307
- SSDEEP
  
  3072:O0O9ibCRpHnL972hGbVl2nES48tezHem:XwlRpHLl2vESMim
Score

10^/10

systembc trojan
- SystemBC
  SystemBC is a proxy and remote administration tool first seen in 2019.
  trojan systembc
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Uses Tor communications
  Malware can proxy its traffic through Tor for more anonymity.
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Connection Proxy

Impact

Tasks

static1

behavioral1

behavioral2