MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08fdb6c4bdfd23bbd7e438eb0644eaf2f204e6d1aeff3e6cbaf7513beba2e717. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SystemBC


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08fdb6c4bdfd23bbd7e438eb0644eaf2f204e6d1aeff3e6cbaf7513beba2e717
SHA3-384 hash: ea8e31f7aaa8a47c1fa41d2e90d18b175ed367257d47a3cd3d8bbc876e7085bd0c0f1bcb0ee6e5b8e30d62ac1eb06541
SHA1 hash: 798b6e0d95948ddadfdf43ed3799d728c7d6a486
MD5 hash: a4bc151814a8f8e9ba2a3160c23a3b32
humanhash: hotel-robert-seven-north
File name:SecuriteInfo.com.Trojan.GenericKD.65353582.8245.14486
Download: download sample
Signature SystemBC
Create hunting rule
File size:1'522'576 bytes
First seen:2023-02-07 10:49:09 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash a2833106949ae6e20c40ed0128f9df4b (5 x RecordBreaker, 4 x SystemBC, 3 x RedLineStealer)
ssdeep 24576:Cnn39uRRlsmAukvhe/z+KrsHc5OHo3iwdabM/gJur7di6opc4KTG165mlt11MzsM:Cn39ssmAukCz+4sHc4I3BEZsrM6o1KTh
Threatray 27 similar samples on MalwareBazaar
TLSH T1C465F1A57207BDC7CCA86C70DCEBC2107670AFDA49C05D560F9EBA0B4A399B5870F562
TrID 30.2% (.EXE) Win64 Executable (generic) (10523/12/4)
18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.9% (.EXE) Win32 Executable (generic) (4505/5/1)
5.9% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 00f0ac66a3db6490 (1 x SystemBC, 1 x RedLineStealer)
Reporter SecuriteInfoCom
Tags:dll signed SystemBC

Code Signing Certificate

Organisation:Encor Burn Inc.
Issuer:Encor Burn Inc.
Algorithm:sha1WithRSA
Valid from:2018-12-31T21:00:00Z
Valid to:2098-12-31T21:00:00Z
Serial number: 78d1ee690af03a8f4f314d743edf4979
Thumbprint Algorithm:SHA256
Thumbprint: 3f49cb8b519da7c2539f02b7de81ed1e86f9dee617b7270c99fb2e57fd7f9cdb
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
239
Origin country :
n/a
Vendor Threat Intelligence
Detection:
SystemBC
Create hunting rule
Link:
https://www.capesandbox.com/analysis/361331/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.65353582.8245.14486.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed virus
Link:
https://www.filescan.io/uploads/63e22cdc1c9cbf7d62565ee9/reports/aade14ac-ba3b-4443-9f7a-074e1d7217c1/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/08fdb6c4bdfd23bbd7e438eb0644eaf2f204e6d1aeff3e6cbaf7513beba2e717
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7b5bc9d0-f015-4f21-a42b-fb5c329ca928
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1167576
Signature
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 800357 Sample: SecuriteInfo.com.Trojan.Gen... Startdate: 07/02/2023 Architecture: WINDOWS Score: 64 26 Multi AV Scanner detection for submitted file 2->26 28 PE file has a writeable .text section 2->28 7 loaddll32.exe 1 2->7         started        process3 signatures4 32 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 7->32 10 cmd.exe 1 7->10         started        12 rundll32.exe 7->12         started        14 WerFault.exe 9 7->14         started        16 conhost.exe 7->16         started        process5 process6 18 rundll32.exe 10->18         started        22 WerFault.exe 20 9 12->22         started        dnsIp7 24 212.118.36.165, 4193, 49726 CITYLAN-ASRU Russian Federation 18->24 30 System process connects to network (likely due to code injection or exploit) 18->30 signatures8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/08fdb6c4bdfd23bbd7e438eb0644eaf2f204e6d1aeff3e6cbaf7513beba2e717/
Threat name:
Win32.Backdoor.Systembc
Create hunting rule
Status:
Malicious
First seen:
2023-02-04 02:59:53 UTC
File Type:
PE (Dll)
Extracted files:
11
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bd63nrf57ur3xv7ehdvqmrhk6lzajzwrv37t43f265itx25c44lq._file
Verdict:
malicious
Similar samples:
435f78485834e4137984372900acb85e4b1ccc277cfd45fbc87476364f546fbb
SystemBC
47514e0e0e65c0d9c143b077dbf243be3068ece155b45ad4b48c07a7614920a3
SystemBC
5c5829697e65e815e41670a142a90251297f8cff94282837c09443b9c1ebad26
SystemBC
682abd62b6e3c0e8ca57f079cd96f2d3848752eaf7002bdf57bfb512bd242811
SystemBC
887d6ad4cffeedfd403427c94439bcb265e54d86e0166956bb978cfa24c55c27
SystemBC
9554df1b2f0b16fd50093a5910776ee26fb8546fc0d0be5a43c868037a92eef9
SystemBC
b34748df4525113b3dc212c943295b4c33ef7b956e89505fd5cf5fe66ee6845a
SystemBC
b3af0eb6e6ddce0f2e2993634d4b3edd86b3584c0c6f6000c5f94379f491698d
SystemBC
+ 17 additional samples on MalwareBazaar
Result
Malware family:
systembc
Create hunting rule
Score:
  10/10
Tags:
family:systembc trojan
Link:
https://tria.ge/reports/230207-mw82ysbb88/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
SystemBC
Unpacked files
SH256 hash:
24955d21dca2b4d0e0e18949cf110c45b30d03fce70f269fffc3f48f248ace6e
MD5 hash:
904c1b94089dff2e621abd18063c7ca5
SHA1 hash:
0bac743b5c868e4de12929d44bce00e9751ef010
Link:
https://www.unpac.me/results/19d82a1e-d5e9-45dd-b9b3-cd02a1142432/
SH256 hash:
08fdb6c4bdfd23bbd7e438eb0644eaf2f204e6d1aeff3e6cbaf7513beba2e717
MD5 hash:
a4bc151814a8f8e9ba2a3160c23a3b32
SHA1 hash:
798b6e0d95948ddadfdf43ed3799d728c7d6a486
Link:
https://www.unpac.me/results/19d82a1e-d5e9-45dd-b9b3-cd02a1142432/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/08fdb6c4bdfd23bbd7e438eb0644eaf2f204e6d1aeff3e6cbaf7513beba2e717

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SystemBC

DLL dll 08fdb6c4bdfd23bbd7e438eb0644eaf2f204e6d1aeff3e6cbaf7513beba2e717

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2532828/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/361331/

Comments