Overview

overview

10

Static

static

7

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a736c699fe879975bc8daa8525984ba514ae96a294f74d570dff0cbfd2117e24

  • Size

    5.9MB

  • Sample

    230807-ttxdpsgc85

  • MD5

    79c80f6c916250dfad7f433e1ff950ee

  • SHA1

    e281b0719592b08b28184decdc1ea5ba9b33e46b

  • SHA256

    a736c699fe879975bc8daa8525984ba514ae96a294f74d570dff0cbfd2117e24

  • SHA512

    d6c1392a886fafb3d750abb32dc4be6f5a01205d51e18cf0456eae7aecb2c6a9ea88e96c9880d7269577f013a91dd1e70e433938b835156ad63ad15b704e84ba

  • SSDEEP

    98304:jLuSoV+yTXcmw9ghSxaq+zRliwT6MAUzk2wQuvvsn+AwUbbXw:+BrBphSxa7zXRTkUzkYuG+AwUPX

Score
10/10
systembctrojanvmprotect

Malware Config

Extracted

Family

systembc

C2

5.42.65.67:4298

localhost.exchange:4298

Targets

    • Target

      a736c699fe879975bc8daa8525984ba514ae96a294f74d570dff0cbfd2117e24

    • Size

      5.9MB

    • MD5

      79c80f6c916250dfad7f433e1ff950ee

    • SHA1

      e281b0719592b08b28184decdc1ea5ba9b33e46b

    • SHA256

      a736c699fe879975bc8daa8525984ba514ae96a294f74d570dff0cbfd2117e24

    • SHA512

      d6c1392a886fafb3d750abb32dc4be6f5a01205d51e18cf0456eae7aecb2c6a9ea88e96c9880d7269577f013a91dd1e70e433938b835156ad63ad15b704e84ba

    • SSDEEP

      98304:jLuSoV+yTXcmw9ghSxaq+zRliwT6MAUzk2wQuvvsn+AwUbbXw:+BrBphSxa7zXRTkUzkYuG+AwUPX

    Score
    10/10
    systembctrojanvmprotect

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Blocklisted process makes network request

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1

MITRE ATT&CK Matrix

Tasks