Extracted

• • Target

    JaffaCakes118_d44096417899cb12d0fe2db404a01bb3294d309dda9e7487cbaa0699c3b457fd

  • Size

    795.6MB

  • MD5

    490cef9b9ed2ff8aafa7ddd3d11d4160

  • SHA1

    8a9592214c2486df6c6074a71c01f29e2572caf1

  • SHA256

    d44096417899cb12d0fe2db404a01bb3294d309dda9e7487cbaa0699c3b457fd

  • SHA512

    8eb4b718a9affb488d8974ceab892b79642fff33d3044feb0cdb7e28e3fdc7e90538d3342a2e853974cf97c3b15a72f4c81f00691e2e2a1c01ff1b714d04a4f0

  • SSDEEP

    49152:ocyNPK4Y1UJLBfIjNC3OIFjtSuiQpVKBuW:Mi/1UDfv317KBuW

  Score

  10^/10

  systembcdiscoverytrojan

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Systembc family

    systembc

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2