systembc | 365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08

Resubmissions

17-04-2024 09:29

240417-lf1vzaah95 10

17-04-2024 09:29

17-04-2024 09:29

17-04-2024 09:28

17-04-2024 09:28

16-04-2024 13:46

Sharing

Copy URL

Twitter E-mail

General

Target

365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08
Size

30KB
MD5

2ad2c7b5700f4246447b90f07ec5359b
SHA1

e9bf283f6dba0c0707a748fbd4a7c6f0c330f7d7
SHA256

365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08
SHA512

625090c4b634c6d95b08bc8965d7445307c242ca9d6fb9e17cf402e82de317c33b21a3a894ec9ff12fbffa2c4fd17d7647c5db3414b81c6f48f565dd2257214c
SSDEEP

768:j4Fd5REMkNoYKNen9OztmVWj9n52yoJImwJcaP:+1EMkNoxMgYVen0yoif

Score

10^/10

systembc

Malware Config

Extracted

Family

systembc

gmstar23.xyz:4044

scgsdstat14tp.xyz:4044

Signatures

Systembc family
systembc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08

Files

365d71d6a6fbc9bbb7efee8d4dd142555708c43b93721f86bbdf1f2f42cd6b08
.exe windows:4 windows x86 arch:x86

17dde48adb7c1f90e4bfb6b6679669b3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetWindowTextA
CreateWindowExA
GetWindowThreadProcessId
LoadCursorA
LoadIconA
RegisterClassA
SendMessageA
ShowWindow
TranslateMessage
UpdateWindow
GetClassNameA
EnumWindows
DispatchMessageA
DefWindowProcA
wsprintfA
GetMessageA

kernel32

WaitForSingleObject
WriteFile
VirtualAlloc
VirtualFree
CloseHandle
CopyFileA
CreateDirectoryA
CreateEventA
CreateFileA
CreateMutexA
CreateThread
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FileTimeToSystemTime
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetEnvironmentVariableA
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
GetVolumeInformationA
LocalAlloc
LocalFree
OpenMutexA
OpenProcess
RemoveDirectoryA
SystemTimeToFileTime
SetFilePointer
Sleep
SetEvent

advapi32

CryptAcquireContextA
CryptExportKey
CryptImportKey
CryptReleaseContext
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
CryptDestroyKey

wsock32

htons
inet_addr
inet_ntoa
ioctlsocket
recv
select
send
setsockopt
shutdown
socket
connect
closesocket
WSAStartup
WSACleanup

shell32

CommandLineToArgvW
ShellExecuteA

ws2_32

freeaddrinfo
WSAIoctl
getaddrinfo

ole32

CoUninitialize
CoInitialize
CoCreateInstance

secur32

InitSecurityInterfaceA
AcquireCredentialsHandleA
DecryptMessage
DeleteSecurityContext
EncryptMessage
FreeContextBuffer
FreeCredentialsHandle
GetUserNameExA
GetUserNameExW
InitializeSecurityContextA
QueryContextAttributesA

crypt32

CryptStringToBinaryA
CryptDecodeObject

psapi

GetModuleFileNameExA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 670B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

Files

17dde48adb7c1f90e4bfb6b6679669b3

Headers

File Characteristics

Imports

user32

kernel32

advapi32

wsock32

shell32

ws2_32

ole32

secur32

crypt32

psapi

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 670B

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 670B