General

  • Target

    SecuriteInfo.com.Win32.SpywareX-gen.19167.22607.exe

  • Size

    1.7MB

  • Sample

    250302-qkjvgawkv6

  • MD5

    9218e5cad03c752f237ed87a9e52def4

  • SHA1

    0ccddab0d87776d78c613c6e7a6f3bce93ffc3d3

  • SHA256

    833610e95cc965e70096620e0adaa8917963df9f9ec56e00af1ff331161a7971

  • SHA512

    4ca94c23bf82bee5ff5a7f7e318e99c084f7403cdc2e23276087f55620f9e9f988a7a6816fedcd2f853a21fe645c3cc89f7b2f6f05f792b549fd698fd14f5cb3

  • SSDEEP

    49152:NWiPyNzLHax6WxKPQx1GyGe4/xU7VNT1xMJ1NxjnW8EtVO:NhGW4OOCbhGQK

Malware Config

Extracted

Family

systembc

C2

towerbingobongoboom.com

213.209.150.137

Targets

    • Target

      SecuriteInfo.com.Win32.SpywareX-gen.19167.22607.exe

    • Size

      1.7MB

    • MD5

      9218e5cad03c752f237ed87a9e52def4

    • SHA1

      0ccddab0d87776d78c613c6e7a6f3bce93ffc3d3

    • SHA256

      833610e95cc965e70096620e0adaa8917963df9f9ec56e00af1ff331161a7971

    • SHA512

      4ca94c23bf82bee5ff5a7f7e318e99c084f7403cdc2e23276087f55620f9e9f988a7a6816fedcd2f853a21fe645c3cc89f7b2f6f05f792b549fd698fd14f5cb3

    • SSDEEP

      49152:NWiPyNzLHax6WxKPQx1GyGe4/xU7VNT1xMJ1NxjnW8EtVO:NhGW4OOCbhGQK

    • SystemBC

      SystemBC is a proxy and remote administration tool first seen in 2019.

    • Systembc family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks