MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03c4a886c03d8eed421aa32b2df96d4b9a107d09aa5d797e69791b1b92794519. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SystemBC


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 03c4a886c03d8eed421aa32b2df96d4b9a107d09aa5d797e69791b1b92794519
SHA3-384 hash: 0fc3658b077d5538c3e83a9d71339158f85add4d18988166ce2167dd45bbfb97471ab8122ddb3f50e19f12882648f8ea
SHA1 hash: fbfec5c5bc40fab91e44e347d3429aa773968e06
MD5 hash: 9d8203962d8b5788b97804558e4347eb
humanhash: lemon-carpet-autumn-oregon
File name:9d8203962d8b5788b97804558e4347eb.exe
Download: download sample
Signature SystemBC
Create hunting rule
File size:1'603'712 bytes
First seen:2022-10-01 07:40:33 UTC
Last seen:2022-10-01 09:02:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 269b0b87297723964e5cbe467c2c5e85 (1 x SystemBC)
ssdeep 24576:277xjRO4/1gy4+aDckmi7DaC+V+aqaGI5KMADy2n1Cpp4c7cxXZw:c7xjRJgywDCyDSWaCM0y2ngHdmu
Threatray 235 similar samples on MalwareBazaar
TLSH T184750201A1D8EA79EBF71174FFBE6B03ED28189A2270D09937D416597332A8D7701B36
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 0c98a6a6a6a68679 (1 x SystemBC)
Reporter abuse_ch
Tags:exe signed SystemBC

Code Signing Certificate

Organisation:*.rich.com
Issuer:Trusted Secure Certificate Authority 5
Algorithm:sha256WithRSAEncryption
Valid from:2022-04-20T00:00:00Z
Valid to:2023-04-20T23:59:59Z
Serial number: 8adbdbbe636982df64a7b53a34402cd0
Thumbprint Algorithm:SHA256
Thumbprint: f89210e94dc69fa3fde33635fe181cfdb3145effb68f89c10d004027c18b7329
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
270
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
systembc
Create hunting rule
ID:
1
File name:
wevtutil.exe
Verdict:
Malicious activity
Analysis date:
2022-09-30 10:40:57 UTC
Tags:
systembc
Link:
https://app.any.run/tasks/db712547-ddf8-4840-a38d-3f08d3254dbc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/315427/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.62418654.29084.32124.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/40377/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed warp
Link:
https://www.filescan.io/uploads/6337ef1349c58ce767c46db6/reports/97619932-1919-4a6a-a994-f9378c4876b6/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6fcef7ea-7f0c-4cbe-9f42-c678b91def84
Result
Threat name:
SystemBC
Create hunting rule
Detection:
malicious
Classification:
evad.troj
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1081413
Signature
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Self deletion via cmd or bat file
Uses ping.exe to check the status of other devices and networks
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected SystemBC
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 713971 Sample: d3f446cRhN.exe Startdate: 01/10/2022 Architecture: WINDOWS Score: 92 42 Malicious sample detected (through community Yara rule) 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Yara detected SystemBC 2->46 48 Machine Learning detection for sample 2->48 7 d3f446cRhN.exe 4 2->7         started        11 Dotay forikiyi bibaja.exe 2->11         started        process3 file4 34 C:\Users\user\...\Dotay forikiyi bibaja.exe, PE32 7->34 dropped 36 Dotay forikiyi bib...exe:Zone.Identifier, ASCII 7->36 dropped 50 Self deletion via cmd or bat file 7->50 52 Uses schtasks.exe or at.exe to add and modify task schedules 7->52 13 Dotay forikiyi bibaja.exe 7->13         started        16 cmd.exe 1 7->16         started        18 schtasks.exe 1 7->18         started        54 Writes to foreign memory regions 11->54 56 Allocates memory in foreign processes 11->56 58 Injects a PE file into a foreign processes 11->58 20 InstallUtil.exe 11->20         started        signatures5 process6 dnsIp7 60 Writes to foreign memory regions 13->60 62 Allocates memory in foreign processes 13->62 64 Injects a PE file into a foreign processes 13->64 23 InstallUtil.exe 13->23         started        66 Uses ping.exe to check the status of other devices and networks 16->66 25 PING.EXE 1 16->25         started        28 conhost.exe 16->28         started        30 chcp.com 1 16->30         started        32 conhost.exe 18->32         started        38 89.22.225.242, 4193, 49835, 49836 INETLTDTR Russian Federation 20->38 signatures8 process9 dnsIp10 40 127.0.0.1 unknown unknown 25->40
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/03c4a886c03d8eed421aa32b2df96d4b9a107d09aa5d797e69791b1b92794519/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-09-30 13:16:38 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
20 of 41 (48.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=apckrbwahwho2qq2umvs36lnjonba7ijvjoxs7tjpenrxetziumq._file
Verdict:
malicious
Similar samples:
118a7af7d60eaec0d2a880691bcfb39839c181447c9e669e4d093d59e936d7bd
SystemBC
44d370f942987d9128b412435dbc50a22566c8fdce819d84568c4c1606c3e466
SystemBC
7dd44d3b3df4f14474d20ffa23e2fb20dcf22ed3a1458b345a1bd85563ac4a62
SystemBC
9967989c15c0f7ae425e0980837f6caa91bd9475e97c935ff1ca9e00964423e6
SystemBC
c1c07edacf90d257f385aecfc40fe808ff8e07ed86754bbfef888c88b088d1a3
SystemBC
d22727a796d337b56dab027f8ab29794b2de14f37e4307d51509418bea5f48b2
SystemBC
f393d8ab0dad57149651772c1987b77a52c604e8c7b9a5810977079a28e946bb
SystemBC
+ 225 additional samples on MalwareBazaar
Result
Malware family:
systembc
Create hunting rule
Score:
  10/10
Tags:
family:systembc trojan
Link:
https://tria.ge/reports/221001-jh493agfhj/
Behaviour
Creates scheduled task(s)
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Deletes itself
Loads dropped DLL
Executes dropped EXE
SystemBC
Malware Config
C2 Extraction:
89.22.225.242:4193
195.2.93.22:4193
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fb0fa9f0-f449-45e1-bdc3-81b0af2c83ae
Unpacked files
SH256 hash:
6b6552c719a9c96bedc57f0e7412ed29912d8dfebdb319e42c34287afba65fa0
MD5 hash:
0f19d26bd831a5a59553c13d2e1e9779
SHA1 hash:
16bd0edf6eb4d71a8af822669f7d5ca34ec6a42a
Link:
https://www.unpac.me/results/30eb9308-07bb-4742-807c-7451d85c75e7/
SH256 hash:
03c4a886c03d8eed421aa32b2df96d4b9a107d09aa5d797e69791b1b92794519
MD5 hash:
9d8203962d8b5788b97804558e4347eb
SHA1 hash:
fbfec5c5bc40fab91e44e347d3429aa773968e06
Link:
https://www.unpac.me/results/30eb9308-07bb-4742-807c-7451d85c75e7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/03c4a886c03d8eed421aa32b2df96d4b9a107d09aa5d797e69791b1b92794519

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SystemBC

Executable exe 03c4a886c03d8eed421aa32b2df96d4b9a107d09aa5d797e69791b1b92794519

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2323699/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/315427/

Comments