systembc | 365f7ff51ec4583ba6a426b15981b9e7[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
365f7ff51ec4583ba6a426b15981b9e7.bin
Size 8KB
Sample240219-b7j2esgh93
SHA256 1e809bb5f85026c31ca54558e986ef87304252f48c354546c74f214c4b443e86
MD5 c28b9c47b02b9bdca1109103e511ae0b
SHA1 16c1adb1f3a80f99406e1f1cad20bc9ff1f51d47
SHA512 ef5902de831206ef2e7d3df91cb775607ab152d6594c6371048c073db179a198ec70f4f565afc4cb26439b108e04c78f5b45f848b513d4671cb77665a737170a
SSDEEP 192:5irhP+Kg93cmOm5hghskkN7jlxTsVTstYB4xPJaX6fcd1OTKtPT/:ArIKg932KgSDRTsOYm1Pf4tL/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

systembc

Malware Config

Extracted

Family

systembc

193.233.21.140:4001

Signatures

Systembc family
systembc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/08dd07978c07ca8d8f51d9033428f23b76fd6c6f7607e39a0e9d28821131261f.exe

File Explorer

365f7ff51ec4583ba6a426b15981b9e7.bin

.zip 8KB
08dd07978c07ca8d8f51d9033428f23b76fd6c6f7607e39a0e9d28821131261f.exe

.exe 16KB

365f7ff51ec4583ba6a426b15981b9e7.bin

SHA256 1e809bb5f85026c31ca54558e986ef87304252f48c354546c74f214c4b443e86
MD5 c28b9c47b02b9bdca1109103e511ae0b
SHA1 16c1adb1f3a80f99406e1f1cad20bc9ff1f51d47
SHA512 ef5902de831206ef2e7d3df91cb775607ab152d6594c6371048c073db179a198ec70f4f565afc4cb26439b108e04c78f5b45f848b513d4671cb77665a737170a
SSDEEP 192:5irhP+Kg93cmOm5hghskkN7jlxTsVTstYB4xPJaX6fcd1OTKtPT/:ArIKg932KgSDRTsOYm1Pf4tL/
MD5 SHA1 SHA512 SSDEEP

Password

infected

08dd07978c07ca8d8f51d9033428f23b76fd6c6f7607e39a0e9d28821131261f.exe

IMPHASH b83b4c7be0b1cdd8e117bba9096d9768
SHA256 08dd07978c07ca8d8f51d9033428f23b76fd6c6f7607e39a0e9d28821131261f
MD5 365f7ff51ec4583ba6a426b15981b9e7
SHA1 2d66a5b213ec43165d0ccaea3a4b9e1bcdd68318
SHA512 7eaa4ca6097b883156dfdcd0fea3c9b18520e8d431665551beae2e1c1e3e104671007ba83cde826fc025f931bfe1d74dc35de0ed184e59dfc9cb6c0b7822cf70
SSDEEP 384:rC+AHNZw/WnlrobdglGbLMoy+yG+yir1dV:r0gklrydgQP1yO67V
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetMessageA GetWindowTextA GetWindowThreadProcessId LoadCursorA LoadIconA CreateWindowExA RegisterClassA SendMessageA ShowWindow TranslateMessage UpdateWindow GetClassNameA EnumWindows DispatchMessageA DefWindowProcA wsprintfA

kernel32

ResetEvent SetEvent SetFilePointer OpenProcess RemoveDirectoryA LocalAlloc WriteFile WaitForSingleObject VirtualFree VirtualAlloc SystemTimeToFileTime CloseHandle CopyFileA CreateDirectoryA CreateEventA CreateFileA CreateMutexA CreateThread CreateToolhelp32Snapshot DeleteFileA ExitProcess FileTimeToSystemTime GetCommandLineW GetCurrentProcess GetCurrentProcessId GetEnvironmentVariableA GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetTempPathA GetVolumeInformationA LocalFree Sleep

advapi32

GetSidSubAuthority GetUserNameW OpenProcessToken GetTokenInformation

wsock32

htons inet_addr inet_ntoa recv select send setsockopt shutdown socket connect closesocket ioctlsocket WSAStartup WSACleanup

shell32

CommandLineToArgvW

ws2_32

freeaddrinfo WSAIoctl getaddrinfo

ole32

CoUninitialize CoInitialize CoCreateInstance

secur32

GetUserNameExW QueryContextAttributesA AcquireCredentialsHandleA DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle GetUserNameExA InitializeSecurityContextA

psapi

GetModuleFileNameExA