Extracted

Extracted

• • Target

    bluemail.exe

  • Size

    1.6MB

  • MD5

    8df3fab98637bc32a59a5195ff453cab

  • SHA1

    fbbfefa642a2babf53461ea0a9a3651c3fcbb7f6

  • SHA256

    253902ece28a0b9e0a03441cbc0b72ebed093e27714b58a8bd95ccabde90edf0

  • SHA512

    4a4236fb5ed624d9642184d8ba1fd83027165b4dea52c2f74205a0da3c6d8e152c6cd3dddf1f3b0d509501b18a332232c94307d1ac97cf7abf9e5cdba1dc7ec2

  • SSDEEP

    49152:fIBW16KkCbCAcAGXnzR0Uzbt2/W2GmSA8EAp0m:fIM162CsGXnz6XGmSoK

  Score

  10^/10

  systembcdefense_evasiondiscoverytrojan

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Systembc family

    systembc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1