Extracted

• • Target
    5d7e265ed53bd43d40f6457318a0921d_JaffaCakes118
  • Size 209KB
  • SHA256 dfe0c8f95bf96e2be4666d73ef9cd166e89eef631e975aa2e384d9f1af901d45
  • MD5 5d7e265ed53bd43d40f6457318a0921d
  • SHA1 08d676809ac123f9a42a7ad4c8b86a3f2237580d
  • SHA512 3f1c65337295aefff9781e099a7d298f2308f5639ab0fc34cc1e716b68991b6abdac195964083bb7d3bdc36ca25a4652ab482fd943ca1f4190c71222b60d7a43
  • SSDEEP 6144:YDnLgI91y1UkT57iJz/DpURWPSvHuUiYphu1UW:cnLh9yn52rpUR5vHuRYpM+W
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  systembcdiscoverytrojanupx

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Contacts a large (726) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications

    Malware can proxy its traffic through Tor for more anonymity.

  behavioral1behavioral2behavioral3behavioral4