systembc | B950169921D1437CEF4A85778CD81636[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
B950169921D1437CEF4A85778CD81636.dll
Size 30KB
Sample231118-fx5btsbe86
SHA256 da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c
MD5 b950169921d1437cef4a85778cd81636
SHA1 3d20b1c6f93029ab557819efd1f32afc25ac1e88
SHA512 d0b87c1a119ba712c8b85fcb442286133320ec03df589276106987f2947ebbc603dfabaad7e2efbec4998067ef508f1c12bbc5a54502097665315a7b9ba9cf70
SSDEEP 768:Ugj98hSEzIOxO+OZWBaFWsBC7wU6LPLoEf73Wud9BdoJrZmZEMb+:Z0IOxO+OZWBGWsB+w93L39BdoD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

systembc

Malware Config

Extracted

Family

systembc

37.220.86.73:4001

Signatures

Systembc family
systembc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
B950169921D1437CEF4A85778CD81636.dll

File Explorer

B950169921D1437CEF4A85778CD81636.dll

.dll 30KB

B950169921D1437CEF4A85778CD81636.dll

IMPHASH 68a4d66732977014d6d8b63cdbe7534b
SHA256 da6a04e55e07cfd3c541c340e945c4dad38ac8d414d38dadd3f406f9c954652c
MD5 b950169921d1437cef4a85778cd81636
SHA1 3d20b1c6f93029ab557819efd1f32afc25ac1e88
SHA512 d0b87c1a119ba712c8b85fcb442286133320ec03df589276106987f2947ebbc603dfabaad7e2efbec4998067ef508f1c12bbc5a54502097665315a7b9ba9cf70
SSDEEP 768:Ugj98hSEzIOxO+OZWBaFWsBC7wU6LPLoEf73Wud9BdoJrZmZEMb+:Z0IOxO+OZWBGWsB+w93L39BdoD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

user32

GetWindowTextA GetWindowThreadProcessId LoadCursorA CreateWindowExA LoadIconA RegisterClassA SendMessageA ShowWindow TranslateMessage UpdateWindow GetMessageA GetClassNameA DispatchMessageA DefWindowProcA wsprintfA

kernel32

WaitForSingleObject WriteFile CloseHandle CreateDirectoryA CreateEventA CreateFileA CreateThread CreateToolhelp32Snapshot DeleteFileA FileTimeToSystemTime GetCommandLineW GetCurrentProcess GetCurrentProcessId GetEnvironmentVariableA GetLastError GetLocalTime GetModuleHandleA GetTempPathA GetVolumeInformationA LocalAlloc LocalFree OpenProcess RemoveDirectoryA SetEvent SetFilePointer VirtualFree SystemTimeToFileTime VirtualAlloc Sleep

advapi32

CryptExportKey CryptDestroyKey CryptAcquireContextA CryptReleaseContext GetSidSubAuthority GetTokenInformation GetUserNameW OpenProcessToken CryptImportKey

wsock32

htons inet_addr inet_ntoa ioctlsocket recv select send setsockopt shutdown socket connect closesocket WSAStartup WSACleanup

shell32

CommandLineToArgvW

ws2_32

freeaddrinfo WSAIoctl getaddrinfo

ole32

CoUninitialize CoInitialize CoCreateInstance

secur32

GetUserNameExW QueryContextAttributesA AcquireCredentialsHandleA DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle GetUserNameExA InitSecurityInterfaceA InitializeSecurityContextA

crypt32

CryptStringToBinaryA CryptDecodeObject

psapi

GetModuleFileNameExA