Extracted

• • Target

    feedlablest.exe

  • Size

    1.6MB

  • MD5

    f53198e8b444658cf7134f5ccb466a98

  • SHA1

    0283e56ed7201eecfc7dad30cc6f3f30d677be66

  • SHA256

    936004bbb9d3c4763c0e36cc887b21315ae6c2d55c366cb3b3390d480b827107

  • SHA512

    ee40f63f7b75cc1b55d11c56c25086d2d66ae86a3f65326d5a75cf0f2fac94ebee622cd4844b4f6468b2bfd011ab80558f41e1b62d2a7864b0ce7f61d3bdcf09

  • SSDEEP

    49152:R1aqCQ3KKia9icS8P80nPIIXQocVHmir6QmEGmNyRzs3X0W:R1aA37ia9iJ800QIXQocVHoEGVM

  Score

  10^/10

  systembcdefense_evasiondiscoverytrojan

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • Systembc family

    systembc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1