Extracted

• • Target

    Dsfpk.exe

  • Size

    1019KB

  • MD5

    a2db8a666e3c03f04aafd86aa68a0ed1

  • SHA1

    03c31e7c1e3156fdced6cf7345a21c06db1836dc

  • SHA256

    9a3d939bbe9de696c16e62809944be0258ca11c2117381fdc0b5fa1986606191

  • SHA512

    5ffff2f496d2a581d58e87b3a22b076d6ec0b8389f6cacc737c1cd9386ce33cbd873284226d665f4856aa08d5dfde322c3f4bf18254d47ba8b0cbb1e0165c2bf

  • SSDEEP

    24576:6vCnHLe19bQ8JbpTFd0vcLSG7FuEw2C2:6vUrWWalT7nSG

  Score

  10^/10

  discoverysystembctrojan

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Systembc family

    systembc

  • Drops startup file

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2