Extracted

• • Target

    coredrive.exe

  • Size

    1.6MB

  • MD5

    c6a399eb155322a8cbf1390c118553cb

  • SHA1

    c59b0aa34638e8991358520e29625bb7fb4e3b6b

  • SHA256

    a7c8390922ecfe4e4be4c9ffff567e91298a8bbf96dc96318305f45ec59f5221

  • SHA512

    6437b6ea8990130f8e69b113f6ec8310e8831a80a2cf7ef1d8d16b323729a89c4a00a8900030e77f5671a7a40971e519731ec22519d98d7af29577dcb5dfe44e

  • SSDEEP

    49152:R1aqCQ3KKia9icS8P80nPIIXQocVHmir6QmEGmNyRzs3X:R1aA37ia9iJ800QIXQocVHoEGV

  Score

  10^/10

  systembcdefense_evasiondiscoverytrojan

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Systembc family

    systembc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2