MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e08b9cd0e2bb7ca4a8fdace85c5e80ebab87986ed6541a056ff31bdc272f173. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SystemBC


Vendor detections: 14


Intelligence 14 IOCs YARA 6 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e08b9cd0e2bb7ca4a8fdace85c5e80ebab87986ed6541a056ff31bdc272f173
SHA3-384 hash: a3f8e08ad805d9e3fb42159f15acfbe5d7fda4c933d611178f0486815a9d9d6f92536c15006a359c7b5ae40232284b7a
SHA1 hash: b41f90962e9c53617d93be473914364d5a180c6c
MD5 hash: 584e1b772abf47e40b94652be9117be8
humanhash: artist-lemon-mountain-blossom
File name:584e1b772abf47e40b94652be9117be8
Download: download sample
Signature SystemBC
Create hunting rule
File size:1'023'720 bytes
First seen:2023-02-20 11:35:09 UTC
Last seen:2023-02-20 13:32:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4a43ef13050d45ae61812b2997033821 (2 x GCleaner, 1 x SystemBC, 1 x Rhadamanthys)
ssdeep 24576:j0YP8i28caNN64mX1LRJIv48/sUmBfHZfunQi:VitXBR2v48/sNBsQi
Threatray 184 similar samples on MalwareBazaar
TLSH T1DB25F1545CF874E6D787C6F6C844EA6014326EB02B8647D6B09A8B070D78FD15E3EBA3
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon f68a0f333393cad6 (1 x SystemBC)
Reporter zbetcheckin
Tags:32 exe signed SystemBC

Code Signing Certificate

Organisation:*.estreet.com
Issuer:RapidSSL Global TLS RSA4096 SHA256 2022 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2022-12-22T00:00:00Z
Valid to:2024-01-04T23:59:59Z
Serial number: 06a13a55e15439ed2a1a49790d4a7289
Intelligence: 6 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: dd661248835212024e635dea675568765ee6061850cb7acc8ce8dc8cb41161a4
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
229
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
584e1b772abf47e40b94652be9117be8
Verdict:
Suspicious activity
Analysis date:
2023-02-20 11:37:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8942fd9e-134f-44b0-92fc-3060d66fc2c7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SystemBC
Create hunting rule
Link:
https://www.capesandbox.com/analysis/368399/
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.4095.26891.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Creating a window
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/71832/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckScreenResolution
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/63f35b2401b99ad33e7ea644/reports/32a5eb36-4e7e-444f-ae6f-76d239957d1d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/2e08b9cd0e2bb7ca4a8fdace85c5e80ebab87986ed6541a056ff31bdc272f173
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Mustang Panda
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3eec99af-7605-4f29-8c2f-bc83c71cd9a3
Result
Threat name:
SystemBC
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1179152
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates autostart registry keys with suspicious values (likely registry only malware)
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Suspicious powershell command line found
Yara detected SystemBC
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 811977 Sample: dCsRbJUVqr.exe Startdate: 20/02/2023 Architecture: WINDOWS Score: 88 31 Multi AV Scanner detection for domain / URL 2->31 33 Antivirus detection for URL or domain 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 4 other signatures 2->37 6 dCsRbJUVqr.exe 1 6 2->6         started        10 powershell.exe 11 2->10         started        12 powershell.exe 12 2->12         started        process3 dnsIp4 23 210.16.67.250, 3000, 49706, 49707 ITEXTRON-AS-APTEXTRONCORPORATIONPH Japan 6->23 25 mg5pgwcsys32sjahgugdmjmxrcq.avlzs40baztn 6->25 39 Creates autostart registry keys with suspicious values (likely registry only malware) 6->39 14 dCsRbJUVqr.exe 6 10->14         started        17 conhost.exe 10->17         started        19 dCsRbJUVqr.exe 6 12->19         started        21 conhost.exe 12->21         started        signatures5 process6 dnsIp7 27 mg5pgwcsys32sjahgugdmjmxrcq.avlzs40baztn 14->27 29 mg5pgwcsys32sjahgugdmjmxrcq.avlzs40baztn 19->29
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e08b9cd0e2bb7ca4a8fdace85c5e80ebab87986ed6541a056ff31bdc272f173/
Threat name:
Win32.Backdoor.Systembc
Create hunting rule
Status:
Malicious
First seen:
2023-02-20 11:36:08 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
16 of 25 (64.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fyelttiofo34usup3lhilrpib25lq6mg5vsudicw74y33qts6fzq._file
Verdict:
malicious
Similar samples:
15347a41c9a5909a7fffbc8f89c7b0154dafe57ac80e9a153ffda2936f63b24a
SystemBC
4d59d088de40abcfd78f88d45009dbfdd14d9df76b718bc1c27241ec2807ef8d
SystemBC
5c5829697e65e815e41670a142a90251297f8cff94282837c09443b9c1ebad26
SystemBC
6779c5bd995a94b8e53173cd3be2e59adcca2f9775674dc681565eef4197627e
SystemBC
812d4d9446b7962344e389b9498d08dabce1c9113bb18f554633da7e5992c4a3
SystemBC
bbaf5140518acfc1cd69cc595184869b0f6adda59134f83566393bc3435fb9d3
SystemBC
c81d0001db2319c3774dff80f346801f493b45c92bd4e825895495158fdf2e9d
SystemBC
d0bfc35b60cf80f2b52779d06d08ddf2d01f784b0f28fed75d58aa3366656a3b
SystemBC
dfc14db8ebe89dab82aaf1476fd573acf91fab5c7a048320f9f7aa68193fceef
SystemBC
+ 174 additional samples on MalwareBazaar
Result
Malware family:
systembc
Create hunting rule
Score:
  10/10
Tags:
family:systembc persistence trojan
Link:
https://tria.ge/reports/230220-nqk9daag89/
Behaviour
Suspicious behavior: EnumeratesProcesses
Adds Run key to start application
SystemBC
Malware Config
C2 Extraction:
210.16.67.250:3000
192.168.1.28:3000
Unpacked files
SH256 hash:
367fab5d97f440cbd1ca9e5aee26d8bb0d4b0acf881d1f06d07ba50554f06181
MD5 hash:
90f63760f114ef48ead9ed95d51ed8a4
SHA1 hash:
06bbe3db5f727741ae3dcdcb35d0e4fd55622bad
Link:
https://www.unpac.me/results/3cac3246-f301-4200-9dcd-ec26e3b41cd3/
SH256 hash:
2e08b9cd0e2bb7ca4a8fdace85c5e80ebab87986ed6541a056ff31bdc272f173
MD5 hash:
584e1b772abf47e40b94652be9117be8
SHA1 hash:
b41f90962e9c53617d93be473914364d5a180c6c
Link:
https://www.unpac.me/results/3cac3246-f301-4200-9dcd-ec26e3b41cd3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2e08b9cd0e2bb7ca4a8fdace85c5e80ebab87986ed6541a056ff31bdc272f173

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Start2__bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:SystemBC_Socks
Create hunting rule
Author:@bartblaze
Description:Identifies SystemBC RAT, Socks proxy version.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SystemBC

Executable exe 2e08b9cd0e2bb7ca4a8fdace85c5e80ebab87986ed6541a056ff31bdc272f173

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2545705/
Cape
Cape
https://www.capesandbox.com/analysis/368399/

Comments


Avatar
zbet commented on 2023-02-20 11:35:11 UTC

url : hxxp://77.91.84.92/lYPDaniZMMCZ.exe