Overview

overview

10

Static

static

7

09800c68e1...dc.exe

windows7-x64

10

09800c68e1...dc.exe

windows7-x64

10

09800c68e1...dc.exe

windows10-1703-x64

10

09800c68e1...dc.exe

windows10-2004-x64

10

09800c68e1...dc.exe

windows11-21h2-x64

10

Resubmissions

17-04-2024 12:47

240417-p1aq3ahc4w 10

17-04-2024 12:47

240417-pz95jafg23 10

17-04-2024 12:47

240417-pz9h1afg22 10

17-04-2024 12:46

240417-pz56ksff97 10

17-04-2024 12:46

240417-pz49aahc3t 10

17-04-2024 06:16

240417-g1qhhsff94 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc

  • Size

    221KB

  • Sample

    240417-pz49aahc3t

  • MD5

    364d59e179ebcd469dce4f231789732d

  • SHA1

    bc86ba43147fe0d301a32b66193dd2930b8af1d2

  • SHA256

    09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc

  • SHA512

    92ae882cb803b23dc344a42b07ffcc77999f71dcd6b7bf1d2ca7e7306a7642543a2cc85f2bdf18df67151a8b2145509363b2552d4e5361715bc55b934db046fe

  • SSDEEP

    6144:0YlvDFWQtzoa2gUayZSSnBcaa5MKmtVgykK:BNtzPqUgkNM4

Score
10/10
systembctrojanupx

Malware Config

Extracted

Family

systembc

C2

yan0212.com:4039

yan0212.net:4039

Targets

    • Target

      09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc

    • Size

      221KB

    • MD5

      364d59e179ebcd469dce4f231789732d

    • SHA1

      bc86ba43147fe0d301a32b66193dd2930b8af1d2

    • SHA256

      09800c68e162c77868d7f4bf14cf89b63d4c3e62a3da81a21455633f469ffcdc

    • SHA512

      92ae882cb803b23dc344a42b07ffcc77999f71dcd6b7bf1d2ca7e7306a7642543a2cc85f2bdf18df67151a8b2145509363b2552d4e5361715bc55b934db046fe

    • SSDEEP

      6144:0YlvDFWQtzoa2gUayZSSnBcaa5MKmtVgykK:BNtzPqUgkNM4

    Score
    10/10
    systembctrojanupx

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

    behavioral1behavioral2behavioral3behavioral4behavioral5

MITRE ATT&CK Matrix ATT&CK v13

Tasks