Extracted

• • Target

    64b58794801f282e92571676e3571afc5c59033c262406bf0d36e1d6ef3cda6a

  • Size

    924KB

  • MD5

    de64bb0f39113e48a8499d3401461cf8

  • SHA1

    8d78c2d4701e4596e87e3f09adde214a2a2033e8

  • SHA256

    64b58794801f282e92571676e3571afc5c59033c262406bf0d36e1d6ef3cda6a

  • SHA512

    35b7cdcfb866dcdc79be34066a9ad5a8058b80e68925aeb23708606149841022de17e9d205389c13803c01e356174a2f657773df7d53f889e4e1fc1d68074179

  • SSDEEP

    24576:NAHFp2K15zXnjfQb6+jFb5RIAJTOcA4gnPdCPPd7wm:WHf15zM5JbtA4wPdCnd75

  Score

  10^/10

  systembcdiscoverypersistencetrojan

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Systembc family

    systembc

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1