General

  • Target

    scks.exe

  • Size

    934KB

  • Sample

    230507-k9drvsdg94

  • MD5

    3d339c1499363d7571073f9347c9fdb6

  • SHA1

    88437e51dd3872af3658b57e7f489758e8cbf31d

  • SHA256

    6f78256f20eb2b5594391095a341f8749395e7566fdd2ddd3a34a0db9bb9f871

  • SHA512

    110ebaa176a7c8613f2f7d36d75805c9e3ecc747e4b3aadf6a3306e6f4f5ad46c187e4bc70ee50d9cca42a7f0ee03e660b921cb21ae71d1858e83faa231a1421

  • SSDEEP

    24576:aB7AHpszdFvDDXCnYydIrQldFu8hod/QodlyzJ8:axFzvSYyd5FadRdd

Malware Config

Extracted

Family

systembc

C2

15.204.166.162:5757

194.87.111.29:5757

Targets

    • Target

      scks.exe

    • Size

      934KB

    • MD5

      3d339c1499363d7571073f9347c9fdb6

    • SHA1

      88437e51dd3872af3658b57e7f489758e8cbf31d

    • SHA256

      6f78256f20eb2b5594391095a341f8749395e7566fdd2ddd3a34a0db9bb9f871

    • SHA512

      110ebaa176a7c8613f2f7d36d75805c9e3ecc747e4b3aadf6a3306e6f4f5ad46c187e4bc70ee50d9cca42a7f0ee03e660b921cb21ae71d1858e83faa231a1421

    • SSDEEP

      24576:aB7AHpszdFvDDXCnYydIrQldFu8hod/QodlyzJ8:axFzvSYyd5FadRdd

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks