Extracted

• • Target
    2d3ba7dd14b9a579b2626fa5baee19bd
  • Size 209KB
  • SHA256 42a191ee4f9593db8f514cce85ad8b9d6533bc71983a9529e7a5d68764d21679
  • MD5 2d3ba7dd14b9a579b2626fa5baee19bd
  • SHA1 dd365103583cfb3c10b73efc6592f8b80c1d75e0
  • SHA512 29efd1035df73572efea0d96017772481b9858855c12d1bb96fc6a4ccd49443a4bb0d1bd86c69dda4218f04e8855ec37c4515157b75a240a530792232c4f03c0
  • SSDEEP 6144:YDnLgI91y1UkT57iJz/DpURWPSvHuUiYphu1UY:cnLh9yn52rpUR5vHuRYpM+Y
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  systembcdiscoverytrojanupx

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Contacts a large (710) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications

    Malware can proxy its traffic through Tor for more anonymity.

  behavioral1behavioral2behavioral3behavioral4