Extracted

• • Target
    2ff18fb4a4d05b7d419a88167d7001bb000eac2f4861bf3849a713b6b701f4c9
  • Size 209KB
  • SHA256 2ff18fb4a4d05b7d419a88167d7001bb000eac2f4861bf3849a713b6b701f4c9
  • MD5 8e9ddb099e71555326413d9a3a930584
  • SHA1 96350dae3f42d37341b3da7410aabe5c42384156
  • SHA512 8d34f32ee48e3d399e020ba3ab4eeab9f1fbdb55a4a5b61b120280975990058221c75be001d09b4f804400977bb769e9ba1fdbd68e90f7db97bd78a69001f09c
  • SSDEEP 6144:YDnLgI91y1UkT57iJz/DpURWPSvHuUiYphu1Ux:cnLh9yn52rpUR5vHuRYpM+x
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  systembctrojanupx

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications

    Malware can proxy its traffic through Tor for more anonymity.

  behavioral1behavioral2behavioral3behavioral4behavioral5