systembc | jaffacakes118_23240166288[.]zip

General

Target
jaffacakes118_23240166288.zip
Size 7KB
Sample260911-1a8e7aeb29
SHA256 75c22e2a30d14585112f43444404005346c7e40ea2165e47a7bda381de446eee
MD5 2b6e48efaa245921dd16cfb50b68cd06
SHA1 bd43ad631a7a790e4bb03ae043acb43297fc7d2f
SHA512 898557544afaada0a784f1b50a893a7a44ee801263d11c3654c63983354b2db2f5eb14290c0b39583726d052e1a942c7ee43df0aac0a711420436155ab438fd1
SSDEEP 192:Mb8kcZ88EcW6+VmdrJoJWLS6rm+Wynlfs+Lg2n3yZpQUoapky:Mb8JeZHEKWLSwWylfQYiZphJpr
TLSH
T104F19EAEC667A02AEEA45438995A8C51ECE2144FFDC76B61D4AFD8CE5810305E3D2F01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan systembc

Malware Config

Extracted

Family

systembc

C2

94.232.46.202:4321
192.168.1.28:4321

Signatures

Family: SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/df903c620508011ca8eb2aaaf9712a526b31a12c800b856cd524ebb3fde854b2

File Explorer

jaffacakes118_23240166288.zip

.zip 7KB
df903c620508011ca8eb2aaaf9712a526b31a12c800b856cd524ebb3fde854b2

.exe 15KB

jaffacakes118_23240166288.zip

SHA256 75c22e2a30d14585112f43444404005346c7e40ea2165e47a7bda381de446eee
MD5 2b6e48efaa245921dd16cfb50b68cd06
SHA1 bd43ad631a7a790e4bb03ae043acb43297fc7d2f
SHA512 898557544afaada0a784f1b50a893a7a44ee801263d11c3654c63983354b2db2f5eb14290c0b39583726d052e1a942c7ee43df0aac0a711420436155ab438fd1
SSDEEP 192:Mb8kcZ88EcW6+VmdrJoJWLS6rm+Wynlfs+Lg2n3yZpQUoapky:Mb8JeZHEKWLSwWylfQYiZphJpr
TLSH
T104F19EAEC667A02AEEA45438995A8C51ECE2144FFDC76B61D4AFD8CE5810305E3D2F01
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

df903c620508011ca8eb2aaaf9712a526b31a12c800b856cd524ebb3fde854b2

IMPHASH 3a0233c129f2514486a242d7d5874037
SHA256 df903c620508011ca8eb2aaaf9712a526b31a12c800b856cd524ebb3fde854b2
MD5 97b70e89b5313612a9e7a339ee82ab67
SHA1 f164332a0103c4ea21fb4f922f73078b565190e7
SHA512 cdcb80a964036a36fcf532271502d452e8b6cb90d9e528df46c417a40f3bb2e1dba8758c8264547d1ab377f405645b4b4617098aa3fb7096e20cf5ac25bb28e6
SSDEEP 384:8/wK8VcHXC3pA/ZbdrJXNcQbvZWXhphZBZKICmo:se2XJBbxJXZchph5/CX
TLSH
T14962F76770A1CAB5C046C2F97F2EF211D06E69715630C039EFE05E28377D6939721A4B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

LoadCursorA LoadIconA PostQuitMessage RegisterClassA ShowWindow TranslateMessage UpdateWindow wsprintfA CreateWindowExA GetMessageA DispatchMessageA DefWindowProcA

kernel32

WaitForSingleObject WriteFile SetFilePointer VirtualFree CloseHandle CreateEventA CreateFileA CreateMutexA CreateThread ExitProcess FileTimeToSystemTime GetCommandLineA GetCurrentProcess GetLocalTime GetModuleFileNameA GetModuleHandleA GetTempPathA GetVolumeInformationA LocalAlloc LocalFree OpenMutexA SetEvent VirtualAlloc Sleep SystemTimeToFileTime

advapi32

RegOpenKeyExA GetTokenInformation OpenProcessToken RegCloseKey RegSetValueExA GetSidSubAuthority RegDeleteValueA RegCreateKeyExA

wsock32

closesocket connect inet_addr inet_ntoa ioctlsocket recv select send setsockopt shutdown socket htons WSAStartup

ws2_32

freeaddrinfo WSAIoctl getaddrinfo

ole32

CoUninitialize CoInitialize CoCreateInstance

secur32

GetUserNameExA AcquireCredentialsHandleA DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle GetUserNameExW QueryContextAttributesA InitializeSecurityContextA

Sharing