systembc | 0b0466996b77c223295a05899525df93489cfda27c7c95b78bec4c6a595629d5

Resubmissions

07/05/2024, 12:39

240507-pvlldaga5110

07/05/2024, 12:38

07/05/2024, 12:38

07/05/2024, 12:38

07/05/2024, 12:38

25/04/2024, 12:54

Sharing

Copy URL Twitter E-mail

General

Target
0b0466996b77c223295a05899525df93489cfda27c7c95b78bec4c6a595629d5
Size 30KB
Sample240507-pvh59aaf49
SHA256 0b0466996b77c223295a05899525df93489cfda27c7c95b78bec4c6a595629d5
MD5 87968a631411cdf26058e8ae5a0902a5
SHA1 a09dc0e8855780430d10811834da6504eb1d72ad
SHA512 07ce6246217a61085ae0ab7a6fade6429d7d946c4970ce79c1a7e22e1fc5f15949a09a0b04ec5bdc00cfd7bb5b11b6cfc5d8fbc9a3f39875443a1bbe7301644e
SSDEEP 768:4TwkPr8C6fuFdaAna6DCPt34GuYY92rjnPoJlvcaII1:MV8C6fuFdaz6+O1n2rjnPo7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

systembc

Malware Config

Extracted

Family

systembc

pzlkxadvert475.xyz:4044
pzfdmserv275.xyz:4044

Signatures

Systembc family
systembc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b0466996b77c223295a05899525df93489cfda27c7c95b78bec4c6a595629d5

File Explorer

0b0466996b77c223295a05899525df93489cfda27c7c95b78bec4c6a595629d5

.exe 30KB

0b0466996b77c223295a05899525df93489cfda27c7c95b78bec4c6a595629d5

IMPHASH 17dde48adb7c1f90e4bfb6b6679669b3
SHA256 0b0466996b77c223295a05899525df93489cfda27c7c95b78bec4c6a595629d5
MD5 87968a631411cdf26058e8ae5a0902a5
SHA1 a09dc0e8855780430d10811834da6504eb1d72ad
SHA512 07ce6246217a61085ae0ab7a6fade6429d7d946c4970ce79c1a7e22e1fc5f15949a09a0b04ec5bdc00cfd7bb5b11b6cfc5d8fbc9a3f39875443a1bbe7301644e
SSDEEP 768:4TwkPr8C6fuFdaAna6DCPt34GuYY92rjnPoJlvcaII1:MV8C6fuFdaz6+O1n2rjnPo7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetWindowTextA CreateWindowExA GetWindowThreadProcessId LoadCursorA LoadIconA RegisterClassA SendMessageA ShowWindow TranslateMessage UpdateWindow GetClassNameA EnumWindows DispatchMessageA DefWindowProcA wsprintfA GetMessageA

kernel32

WaitForSingleObject WriteFile VirtualAlloc VirtualFree CloseHandle CopyFileA CreateDirectoryA CreateEventA CreateFileA CreateMutexA CreateThread CreateToolhelp32Snapshot DeleteFileA ExitProcess FileTimeToSystemTime GetCommandLineW GetCurrentProcess GetCurrentProcessId GetEnvironmentVariableA GetLocalTime GetModuleFileNameA GetModuleHandleA GetTempPathA GetVolumeInformationA LocalAlloc LocalFree OpenMutexA OpenProcess RemoveDirectoryA SystemTimeToFileTime SetFilePointer Sleep SetEvent

advapi32

CryptAcquireContextA CryptExportKey CryptImportKey CryptReleaseContext GetSidSubAuthority GetTokenInformation OpenProcessToken CryptDestroyKey

wsock32

htons inet_addr inet_ntoa ioctlsocket recv select send setsockopt shutdown socket connect closesocket WSAStartup WSACleanup

shell32

CommandLineToArgvW ShellExecuteA

ws2_32

freeaddrinfo WSAIoctl getaddrinfo

ole32

CoUninitialize CoInitialize CoCreateInstance

secur32

InitSecurityInterfaceA AcquireCredentialsHandleA DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle GetUserNameExA GetUserNameExW InitializeSecurityContextA QueryContextAttributesA

crypt32

CryptStringToBinaryA CryptDecodeObject

psapi

GetModuleFileNameExA

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

0b0466996b77c223295a05899525df93489cfda27c7c95b78bec4c6a595629d5

user32

kernel32

advapi32

wsock32

shell32

ws2_32

ole32

secur32

crypt32

psapi

generic