Overview

overview

10

Static

static

7

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ede84803bface8bb45d2f293d8766f6099dab30b1f2d74207398835ff255e385

  • Size

    5.8MB

  • Sample

    230809-kjbjtahh45

  • MD5

    e3fe0be8cd50ca837069bc2564ab0532

  • SHA1

    05e41077b6ebefe2fc34b03055f8c5b31cff1664

  • SHA256

    ede84803bface8bb45d2f293d8766f6099dab30b1f2d74207398835ff255e385

  • SHA512

    7fd879b48873530aa3d1933e537f99f53909fc3604da6cc88388e51e560b5aecbe31801f3daf2096c190f7c8e1b878e3566874c2e1f937254cbf8a59654e7497

  • SSDEEP

    98304:QrsZ8pbhGL9G900NEOrx0i5P4GzmJPLYJZLKU9Q+Rg8gvUbgQw3/5cU6mWL:QawGMvrui5VWUDLKUe+yN5Qy5cH

Score
10/10
systembctrojanvmprotect

Malware Config

Extracted

Family

systembc

C2

5.42.65.67:4298

localhost.exchange:4298

Targets

    • Target

      ede84803bface8bb45d2f293d8766f6099dab30b1f2d74207398835ff255e385

    • Size

      5.8MB

    • MD5

      e3fe0be8cd50ca837069bc2564ab0532

    • SHA1

      05e41077b6ebefe2fc34b03055f8c5b31cff1664

    • SHA256

      ede84803bface8bb45d2f293d8766f6099dab30b1f2d74207398835ff255e385

    • SHA512

      7fd879b48873530aa3d1933e537f99f53909fc3604da6cc88388e51e560b5aecbe31801f3daf2096c190f7c8e1b878e3566874c2e1f937254cbf8a59654e7497

    • SSDEEP

      98304:QrsZ8pbhGL9G900NEOrx0i5P4GzmJPLYJZLKU9Q+Rg8gvUbgQw3/5cU6mWL:QawGMvrui5VWUDLKUe+yN5Qy5cH

    Score
    10/10
    systembctrojanvmprotect

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Blocklisted process makes network request

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1

MITRE ATT&CK Matrix

Tasks