Extracted

• • Target

    bb0a1a5209fd48e63807b1ba15d6bb69_JaffaCakes118

  • Size

    345KB

  • MD5

    bb0a1a5209fd48e63807b1ba15d6bb69

  • SHA1

    d3170be1c5ae8e2a24cad223c63f382bd796ceb1

  • SHA256

    e86c00bb96428b8c113169da2c996f457ed22467c5ad998e87bb48b65e98ab36

  • SHA512

    d238e9ddece294a5e6edff0fdb372a0433a3bf6f3f64015ac673149a7f59bc3233c1c0874fe5f1387d7a385a52d031e2253e86e58b3384c59f7689d8ac7ea4fd

  • SSDEEP

    6144:aQ6Xl1NFXVdTUMJwA9yLbTMhdbr2X3f+gOkXdhFr:aQwlV8A9yL/iV2XWgO8hFr

  Score

  10^/10

  systembcdiscoverytrojan

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Executes dropped EXE

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications

    Malware can proxy its traffic through Tor for more anonymity.

  behavioral1behavioral2