Overview

overview

10

Static

static

1

JaffaCakes...1f.exe

windows7-x64

10

JaffaCakes...1f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    JaffaCakes118_cc1fc9b4d7144e3842c3259f4b65c1c3113e6be2452c43cf2b55c7e7d84a5c1f
  • Size 402.7MB
  • Sample241230-vtflmatjdx
  • SHA256 cc1fc9b4d7144e3842c3259f4b65c1c3113e6be2452c43cf2b55c7e7d84a5c1f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
systembcdiscoverytrojan

Malware Config

Extracted

Family

  • systembc

C2

  • 185.209.30.138:4127

  • 192.168.1.149:4127

Targets

    • Target
      JaffaCakes118_cc1fc9b4d7144e3842c3259f4b65c1c3113e6be2452c43cf2b55c7e7d84a5c1f
    • Size 402.7MB
    • SHA256 cc1fc9b4d7144e3842c3259f4b65c1c3113e6be2452c43cf2b55c7e7d84a5c1f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    systembcdiscoverytrojan

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Systembc family

      systembc

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks