Overview

overview

10

Static

static

7

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2beeb1e24561fd6ed03890da0afa68e0120776b815f5c60350e06e1d54562f9e

  • Size

    6.0MB

  • Sample

    230730-ffed3sgb25

  • MD5

    0c35071344e18b340cccf9a625a9cdb5

  • SHA1

    08ec02759debfdacab772f76451153eaeaa9ddc7

  • SHA256

    2beeb1e24561fd6ed03890da0afa68e0120776b815f5c60350e06e1d54562f9e

  • SHA512

    a79862aedfc6432d3888280886935ce4efe6c358ea717ebd516e657aa35a78df9f3de9675d8cc3d5669e76d2382de0d984befa6b765683a28e6dbc68d40043ce

  • SSDEEP

    98304:7nUY8k4GVWPxRi1ENvbSMOHcgMaWMJSSqyjbngSnVhSeL62f5x3vHDgW:JR4PxKADLO8gMapJTqJSn3WS5x3vH8W

Score
10/10
systembctrojanvmprotect

Malware Config

Extracted

Family

systembc

C2

5.42.65.67:4298

localhost.exchange:4298

Targets

    • Target

      2beeb1e24561fd6ed03890da0afa68e0120776b815f5c60350e06e1d54562f9e

    • Size

      6.0MB

    • MD5

      0c35071344e18b340cccf9a625a9cdb5

    • SHA1

      08ec02759debfdacab772f76451153eaeaa9ddc7

    • SHA256

      2beeb1e24561fd6ed03890da0afa68e0120776b815f5c60350e06e1d54562f9e

    • SHA512

      a79862aedfc6432d3888280886935ce4efe6c358ea717ebd516e657aa35a78df9f3de9675d8cc3d5669e76d2382de0d984befa6b765683a28e6dbc68d40043ce

    • SSDEEP

      98304:7nUY8k4GVWPxRi1ENvbSMOHcgMaWMJSSqyjbngSnVhSeL62f5x3vHDgW:JR4PxKADLO8gMapJTqJSn3WS5x3vH8W

    Score
    10/10
    systembctrojanvmprotect

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Blocklisted process makes network request

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks