General

  • Target
    JaffaCakes118_b4d9f02fa75686adbfd3ee433b4a4203
  • Size 209KB
  • Sample250109-arn5rssnbl
  • SHA256 8163d2dd713dc31d3a0a234985d7dc735d1106783a401ce585508fefc56230dc
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • systembc

C2
  • yan0212.com:4039

  • yan0212.net:4039

Targets

    • Target
      JaffaCakes118_b4d9f02fa75686adbfd3ee433b4a4203
    • Size 209KB
    • SHA256 8163d2dd713dc31d3a0a234985d7dc735d1106783a401ce585508fefc56230dc
    • MD5 SHA1 SHA512 SSDEEP
    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • Systembc family

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks