Extracted

• • Target

    2ff18fb4a4d05b7d419a88167d7001bb000eac2f4861bf3849a713b6b701f4c9

  • Size

    209KB

  • MD5

    8e9ddb099e71555326413d9a3a930584

  • SHA1

    96350dae3f42d37341b3da7410aabe5c42384156

  • SHA256

    2ff18fb4a4d05b7d419a88167d7001bb000eac2f4861bf3849a713b6b701f4c9

  • SHA512

    8d34f32ee48e3d399e020ba3ab4eeab9f1fbdb55a4a5b61b120280975990058221c75be001d09b4f804400977bb769e9ba1fdbd68e90f7db97bd78a69001f09c

  • SSDEEP

    6144:YDnLgI91y1UkT57iJz/DpURWPSvHuUiYphu1Ux:cnLh9yn52rpUR5vHuRYpM+x

  Score

  10^/10

  systembctrojanupx

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications

    Malware can proxy its traffic through Tor for more anonymity.

  behavioral1behavioral2behavioral3behavioral4behavioral5