MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 329501486d4922ccf3a28e8ecf0046151e7106dc31ea6df33670d0d15d10cf54. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SystemBC


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 329501486d4922ccf3a28e8ecf0046151e7106dc31ea6df33670d0d15d10cf54
SHA3-384 hash: 78533038f6df2e937ae953b4d734357b8fc00cc37150866823ef615c8979a17df175ce5968f2d0389ea9b6555a6b8899
SHA1 hash: 8c6df311b3f42ffab51df0d411cefae923ef0929
MD5 hash: 1cfd78420793c0fafebf0f4e1a09c1ff
humanhash: ceiling-sodium-virginia-monkey
File name:1cfd78420793c0fafebf0f4e1a09c1ff.dll
Download: download sample
Signature SystemBC
Create hunting rule
File size:1'282'712 bytes
First seen:2023-02-08 18:26:28 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash a2833106949ae6e20c40ed0128f9df4b (5 x RecordBreaker, 4 x SystemBC, 3 x RedLineStealer)
ssdeep 24576:BB++leR75eeScNFG0tUDWlmulwI49SnymKLRd:BMseR7IexXM/ulRAsURd
TLSH T1995501410D226B96D2656575FA6F76A0B0C47FF2063087636F3A7DAF7F71382AE01284
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 71cc602a69555569 (1 x SystemBC)
Reporter abuse_ch
Tags:dll signed SystemBC

Code Signing Certificate

Organisation:www.finisher.com
Issuer:www.finisher.com
Algorithm:sha256WithRSAEncryption
Valid from:2023-02-07T22:49:15Z
Valid to:2024-02-07T23:09:15Z
Serial number: 7d3a3f55ce4c7eb74966b98cfcadb5c8
Thumbprint Algorithm:SHA256
Thumbprint: 8ff76d8ae4179bff24f2040bc6093c5c3a246f859403bee5f7ba5be5d7f05507
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Detection:
SystemBC
Create hunting rule
Link:
https://www.capesandbox.com/analysis/362121/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/63e3e979fc4dffab0ccf3a10/reports/7b382d1e-bb98-4292-8cae-3fef8f35b2f9/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/329501486d4922ccf3a28e8ecf0046151e7106dc31ea6df33670d0d15d10cf54
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/2962b010-fcd7-40c9-a59b-43850e145cbb
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1169103
Signature
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 801887 Sample: LEXVmtj4To.dll Startdate: 08/02/2023 Architecture: WINDOWS Score: 60 26 Multi AV Scanner detection for submitted file 2->26 28 PE file has a writeable .text section 2->28 8 loaddll32.exe 1 2->8         started        process3 process4 10 rundll32.exe 8->10         started        14 cmd.exe 1 8->14         started        16 WerFault.exe 9 8->16         started        18 conhost.exe 8->18         started        dnsIp5 24 212.118.36.165, 4193, 49713 CITYLAN-ASRU Russian Federation 10->24 30 System process connects to network (likely due to code injection or exploit) 10->30 20 rundll32.exe 14->20         started        signatures6 process7 process8 22 WerFault.exe 20 9 20->22         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/329501486d4922ccf3a28e8ecf0046151e7106dc31ea6df33670d0d15d10cf54/
Threat name:
Win32.Backdoor.Systembc
Create hunting rule
Status:
Malicious
First seen:
2023-02-08 04:48:00 UTC
File Type:
PE (Dll)
Extracted files:
10
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gkkqcsdnjermz45cr2hm6acgcuphcbw4ghvg34zwodincxiqz5ka._file
Verdict:
malicious
Result
Malware family:
systembc
Create hunting rule
Score:
  10/10
Tags:
family:systembc trojan
Link:
https://tria.ge/reports/230208-w3rkxseb74/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
SystemBC
Unpacked files
SH256 hash:
c9843cea36c0c885bcba63e67f0e111a6eb64918305db1aa00e62abeff3e526f
MD5 hash:
5a1bdc706249e7a514ba50b45c9ffc20
SHA1 hash:
5a7f0410ba6cfaa4e99ce393f1f3afcf65acc70b
Link:
https://www.unpac.me/results/bfbdb280-30b1-471a-836b-237f005e0f3a/
SH256 hash:
329501486d4922ccf3a28e8ecf0046151e7106dc31ea6df33670d0d15d10cf54
MD5 hash:
1cfd78420793c0fafebf0f4e1a09c1ff
SHA1 hash:
8c6df311b3f42ffab51df0d411cefae923ef0929
Link:
https://www.unpac.me/results/bfbdb280-30b1-471a-836b-237f005e0f3a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/329501486d4922ccf3a28e8ecf0046151e7106dc31ea6df33670d0d15d10cf54

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SystemBC

DLL dll 329501486d4922ccf3a28e8ecf0046151e7106dc31ea6df33670d0d15d10cf54

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2532828/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/362121/

Comments