systembc | a21619b981f4e2b4a1858f0457b42491ef99688278816a66e0652d745e110bb9[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

a21619b981f4e2b4a1858f0457b42491ef99688278816a66e0652d745e110bb9.zip
Size

6KB
MD5

15530ecc5e57f61450efb94bdc3ec885
SHA1

3eff4592bcd47cb976eb6e05529cf7b17cd30318
SHA256

19363b70d7ccdbf10eb7633628f1e0d08fb0f85cff897fd758cf2b61c93abd81
SHA512

e175acaa5fc3be5022c28d65bba4e1a0879359b37112c9ef77fd8ecbd4533d41f76d649abd3cf5a9a84d2675558fd5fcdb6d8fef14258e8b4e1e6e633a1d11f7
SSDEEP

96:kXgI240vZB3XrCoy6ucNm9Uq8i8EIiTvxCreAEOZllQU7uGjnTgp/EcoI1s3duyn:lTVRVuW2UJi8k/RiDQSugUp/HKdNUO

Score

10^/10

systembc

Malware Config

Extracted

Family

systembc

185.198.56.2:4171

Signatures

Systembc family
systembc

Files

a21619b981f4e2b4a1858f0457b42491ef99688278816a66e0652d745e110bb9.zip
.zip

Password: infected
a21619b981f4e2b4a1858f0457b42491ef99688278816a66e0652d745e110bb9.exe
.exe windows x86

801793b2be29822524e8824fc3c47535

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SendMessageA
RegisterClassA
LoadIconA
LoadCursorA
GetWindowThreadProcessId
ShowWindow
GetMessageA
TranslateMessage
UpdateWindow
wsprintfA
GetClassNameA
EnumWindows
CreateWindowExA
DispatchMessageA
DefWindowProcA
GetWindowTextA

kernel32

LocalAlloc
OpenProcess
SetEvent
LocalFree
OpenMutexA
GetModuleHandleA
WriteFile
WaitForSingleObject
VirtualFree
VirtualAlloc
SystemTimeToFileTime
Sleep
CloseHandle
CreateEventA
CreateFileA
CreateMutexA
CreateThread
DeleteFileA
ExitProcess
FileTimeToSystemTime
GetCommandLineA
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetLocalTime
GetModuleFileNameA
GetVolumeInformationA
GetProcAddress
GetTempPathA
SetFilePointer

advapi32

GetSidSubAuthority
OpenProcessToken
GetTokenInformation

wsock32

WSAStartup
closesocket
connect
htons
ioctlsocket
recv
select
send
setsockopt
shutdown
socket
WSACleanup

shell32

CommandLineToArgvW

ws2_32

freeaddrinfo
WSAIoctl
getaddrinfo

ole32

CoUninitialize
CoInitialize
CoCreateInstance

secur32

GetUserNameExA
GetUserNameExW

psapi

GetModuleFileNameExA

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 386B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Password: infected

801793b2be29822524e8824fc3c47535

Headers

File Characteristics

Imports

user32

kernel32

advapi32

wsock32

shell32

ws2_32

ole32

secur32

psapi

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1024B - Virtual size: 576B

.reloc Size: 512B - Virtual size: 386B

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1024B - Virtual size: 576B

.reloc
Size: 512B - Virtual size: 386B