Overview

overview

10

Static

static

10

365d71d6a6...08.exe

windows10-2004-x64

10

365d71d6a6...08.exe

windows7-x64

10

365d71d6a6...08.exe

windows10-1703-x64

10

365d71d6a6...08.exe

windows10-2004-x64

10

365d71d6a6...08.exe

windows11-21h2-x64

10

Resubmissions

17-04-2024 09:29

240417-lf1vzaah95 10

17-04-2024 09:29

240417-lf1j7sce6y 10

17-04-2024 09:29

240417-lfzynsah94 10

17-04-2024 09:28

240417-lfvnysah89 10

17-04-2024 09:28

240417-lft3esah88 10

16-04-2024 13:46

240416-q3e91adb3v 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08

  • Size

    30KB

  • Sample

    240417-lf1j7sce6y

  • MD5

    2ad2c7b5700f4246447b90f07ec5359b

  • SHA1

    e9bf283f6dba0c0707a748fbd4a7c6f0c330f7d7

  • SHA256

    365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08

  • SHA512

    625090c4b634c6d95b08bc8965d7445307c242ca9d6fb9e17cf402e82de317c33b21a3a894ec9ff12fbffa2c4fd17d7647c5db3414b81c6f48f565dd2257214c

  • SSDEEP

    768:j4Fd5REMkNoYKNen9OztmVWj9n52yoJImwJcaP:+1EMkNoxMgYVen0yoif

Score
10/10
systembcdiscoverytrojan

Malware Config

Extracted

Family

systembc

C2

gmstar23.xyz:4044

scgsdstat14tp.xyz:4044

Targets

    • Target

      365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08

    • Size

      30KB

    • MD5

      2ad2c7b5700f4246447b90f07ec5359b

    • SHA1

      e9bf283f6dba0c0707a748fbd4a7c6f0c330f7d7

    • SHA256

      365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08

    • SHA512

      625090c4b634c6d95b08bc8965d7445307c242ca9d6fb9e17cf402e82de317c33b21a3a894ec9ff12fbffa2c4fd17d7647c5db3414b81c6f48f565dd2257214c

    • SSDEEP

      768:j4Fd5REMkNoYKNen9OztmVWj9n52yoJImwJcaP:+1EMkNoxMgYVen0yoif

    Score
    10/10
    systembctrojandiscovery

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Contacts a large (634) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Executes dropped EXE

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    behavioral1behavioral2behavioral3behavioral4behavioral5

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1
T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Proxy

1
T1090

Impact

Resource Development

Reconnaissance

Tasks