Extracted

• • Target

    30fee1328110552c83645241f3ebbfb3e743182c9c08d5259cec20941c5c0f4a.exe

  • Size

    1.2MB

  • MD5

    a50e232d3a5a725cf8324977ce2cc2ec

  • SHA1

    6f663cc2a2df04cab4e84048674d118742bf9b55

  • SHA256

    30fee1328110552c83645241f3ebbfb3e743182c9c08d5259cec20941c5c0f4a

  • SHA512

    60b4f15cfeaaa1dd3ffbbb7efc5750272c26d658767ca4d4e493d8c437a222502ec6f017b96155a80d6e9f7f54835880ff7018169ee24856b9c64befca7f06ef

  • SSDEEP

    24576:1dMkfr422JUVryvPAD37f3rZzKbCHS6F+dbAdpBzahM:zfrJWEyvPAnf3rZWmyIy

  Score

  10^/10

  systembcdiscoverytrojan

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Systembc family

    systembc

  • Drops startup file

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1