MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 330690fd9d001e63f7aa537a28d326e7ffcd61d59ba140a637337ccad1cafb52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SystemBC


Vendor detections: 10


Intelligence 10 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 330690fd9d001e63f7aa537a28d326e7ffcd61d59ba140a637337ccad1cafb52
SHA3-384 hash: 6fbb8a0dbcb95a84da1219fe94bebafedb77f34adb0237d0ee28cd449ae6a5295acae803a5d36ba0f55de0e0e14e842b
SHA1 hash: 5aa586a0cd2edf8ddacaa72853a1eb80a50b975b
MD5 hash: 9b5faf228e2047d8d912e406f9a6eca3
humanhash: red-foxtrot-harry-ack
File name:GetUserNames.EXE
Download: download sample
Signature SystemBC
Create hunting rule
File size:725'058 bytes
First seen:2021-03-05 10:37:44 UTC
Last seen:2021-03-05 12:43:26 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3323deda5e2157d6de8131b8aa0765b0 (1 x SystemBC)
ssdeep 12288:RusRYNsWq1PfXPV/aA5hqOzpT3OKuvExS8CYX7/Yih:jxV/aoEOzpjAih
Threatray 8 similar samples on MalwareBazaar
TLSH 6BF48D6731E1C47BD67204354FA5BB7896FBE9604F326AC723940B4D0E39DC6893623A
Reporter 0x746f6d6669
Tags:SystemBC

Intelligence

File Origin
# of uploads :
2
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
socks.exe
Verdict:
No threats detected
Analysis date:
2021-02-25 15:27:19 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/85e4ca06-4fbf-4545-84f2-cc7e9602b1d8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/122440/
Detection(s):
SecuriteInfo.com.Variant.Zusy.368979.21613.25361.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Changing a file
Creating a file
Creating a process with a hidden window
Sending a UDP request
Sending a custom TCP request
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/629662
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/330690fd9d001e63f7aa537a28d326e7ffcd61d59ba140a637337ccad1cafb52/
Threat name:
Win32.Ransomware.Ryuk
Create hunting rule
Status:
Malicious
First seen:
2021-03-04 02:37:55 UTC
AV detection:
25 of 48 (52.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gmdjb7m5aapgh55kkn5cruzg47742yovtoqubjrxgn6mvuok7nja._file
Verdict:
malicious
Similar samples:
4c04dce0d2aa3fbecd1951f680bff98c2c8c11af54103e6e0aa0bb358a5c0824
SystemBC
53e3fa4c1b8f8ae4a3477a70535d4f1c402de87c47c2f906d8a2600f8ba58b4a
SystemBC
61499704920ee633ffb2baab36eb8eb70d5e0426bca584f9a4a872e4b930c417
SystemBC
9356e204a3bab01044003d58937be31f0edfae7ea5c790916178ce1a8d6173ff
SystemBC
9c7b166c818edf7bda6a112376c7bb20dd704ac9eb74be1d387af077a82dc620
SystemBC
d28966990ec27ae9250c919dd814cd1862e9e0e6b6f31a5418ab58de8ebe446a
SystemBC
ee60159a403a0f52899c4b736d4a81cf8a73412e1deb6ffbe06be9e1ca221b82
SystemBC
f363b448e04ba72c4b61578386a4dfb2bce1a21b52b8519d8f203849076efa73
SystemBC
Result
Malware family:
systembc
Create hunting rule
Score:
  10/10
Tags:
family:systembc dave trojan
Link:
https://tria.ge/reports/210305-1ypsclfq3j/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Dave packer
SystemBC
SystemBC Payload
Unpacked files
SH256 hash:
18a664331e35ad33ce80bdad2c18300e3330c6a0238fa1edd5ff24dc01038d5a
MD5 hash:
219e6746e76f93d76c9e2415b735c944
SHA1 hash:
8b8effdae1c746b13aadbe67eb73edbaf6a4e61e
Link:
https://www.unpac.me/results/b87f212d-3bae-42b7-9af2-921ee79c2f75/
SH256 hash:
1e61c04ba5e4ccdb5a54d225d5f93bb558bfffc623460583cd454cec95114fe7
MD5 hash:
1f1d70e24c4ae479d1b1b73b15401118
SHA1 hash:
6f90087127ff7728c1167fe5dd5892db55c03398
Link:
https://www.unpac.me/results/b87f212d-3bae-42b7-9af2-921ee79c2f75/
SH256 hash:
330690fd9d001e63f7aa537a28d326e7ffcd61d59ba140a637337ccad1cafb52
MD5 hash:
9b5faf228e2047d8d912e406f9a6eca3
SHA1 hash:
5aa586a0cd2edf8ddacaa72853a1eb80a50b975b
Link:
https://www.unpac.me/results/b87f212d-3bae-42b7-9af2-921ee79c2f75/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/330690fd9d001e63f7aa537a28d326e7ffcd61d59ba140a637337ccad1cafb52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Cobalt_functions
Create hunting rule
Author:@j0sm1
Description:Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT
Rule name:MALWARE_Win_Emotet
Create hunting rule
Author:ditekSHen
Description:Detects Emotet variants
Rule name:MALWARE_Win_EXEPWSH_DLAgent
Create hunting rule
Author:ditekSHen
Description:Detects downloader agent, using PowerShell
Rule name:Start2_net_bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:Start2_net_mem
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:Start2_overlap_bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:Start2_overlap_mem
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:Start2__bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/122440/

Comments