Overview

overview

10

Static

static

3

SecuriteIn...67.exe

windows7-x64

10

SecuriteIn...67.exe

windows10-2004-x64

10

Resubmissions

14-02-2025 13:34

250214-qt9r9aykh1 10

11-02-2025 10:36

250211-mnkz6avjhy 10

07-02-2025 11:08

250207-m8zztaylgy 10

07-02-2025 07:20

250207-h55nnstlcz 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe

  • Size

    1.7MB

  • Sample

    250214-qt9r9aykh1

  • MD5

    e2df3d65784e6202d297bec31d1dfaa1

  • SHA1

    a74be156066f49f56bd5835e35210591b7010634

  • SHA256

    c539384c0034cc40b226df8cf1354eb264c0e48e722fdd44205ce6783122dba8

  • SHA512

    3e311421b7bd8db2ed11fa3bd6406d96a6506b96c54dcf8ab0ea5b95d208dbb124e3372a7be39e42f25f2c2cf59a35888d489c2a107377b831c470bde8f35dfc

  • SSDEEP

    49152:BGZgyO3gUhNuZ+gw5N2W4FCcDK5juYWwb4EOpRpOm:Qw3gCNTph4rwq+

Score
10/10
systembcdefense_evasiondiscoverytrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.midwich-cuckoos.co.uk
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    folk65

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.caribserve.net
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    mona1

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.cplconstrutora.com.br
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    KhEQsP4Ax

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.nifty.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Kiyo8879

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.nifty.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    keiko9198

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.khoitoan.vn
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Dong@0227#BM

Extracted

Credentials

Extracted

Credentials

Extracted

Family

systembc

C2

wodresomdaymomentum.org

Targets

    • Target

      SecuriteInfo.com.Win32.SpywareX-gen.27164.12067.exe

    • Size

      1.7MB

    • MD5

      e2df3d65784e6202d297bec31d1dfaa1

    • SHA1

      a74be156066f49f56bd5835e35210591b7010634

    • SHA256

      c539384c0034cc40b226df8cf1354eb264c0e48e722fdd44205ce6783122dba8

    • SHA512

      3e311421b7bd8db2ed11fa3bd6406d96a6506b96c54dcf8ab0ea5b95d208dbb124e3372a7be39e42f25f2c2cf59a35888d489c2a107377b831c470bde8f35dfc

    • SSDEEP

      49152:BGZgyO3gUhNuZ+gw5N2W4FCcDK5juYWwb4EOpRpOm:Qw3gCNTph4rwq+

    Score
    10/10
    systembcdefense_evasiondiscoverytrojan

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

      trojansystembc

    • Systembc family

      systembc

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks