MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SystemBC


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc
SHA3-384 hash: afb37d7ca778a9ae954767d979bfb6de2823268b77f4e8c6e7bccf01e2da62b4861bc16f925f22aec2d41dc709a3a6c0
SHA1 hash: c17e4566a2b04520812943be13d1d96a711eaebe
MD5 hash: 54537dfa5c2f6dc982f4f62743825d59
humanhash: ten-orange-virginia-eleven
File name:54537dfa5c2f6dc982f4f62743825d59.exe
Download: download sample
Signature SystemBC
Create hunting rule
File size:918'016 bytes
First seen:2022-07-30 21:20:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ee5096548c06633b7b95be4448b38e66 (1 x SystemBC)
ssdeep 24576:81nS4f/X4aR1R3cDJXEq7q2el0+3J0S57:81SwxNyJX37qCMJ0S
TLSH T10915BF37A2A08732D22E17398C7757BC6935B9502A27588A3BFD1DCC4F35742396A363
TrID 68.5% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
27.0% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
1.4% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.3% (.SCR) Windows screen saver (13101/52/3)
0.4% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (573 x Quakbot, 311 x GCleaner, 137 x ArkeiStealer)
Reporter abuse_ch
Tags:exe SystemBC


Avatar
abuse_ch
SystemBC C2:
178.79.174.207:443

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
178.79.174.207:443 https://threatfox.abuse.ch/ioc/840429/

Intelligence

File Origin
# of uploads :
1
# of downloads :
476
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/295289/
Detection(s):
Win.Malware.Zusy-9947828-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Creating a file
Sending a custom TCP request
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/27857/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
keylogger shell32.dll
Link:
https://www.filescan.io/uploads/62e5a0c56336465f2af97bff/reports/c54d5c97-124c-40f5-9be5-7f4c9bc341f7/overview
Malware family:
SystemBC
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/70d6f74a-e263-4804-9886-322332915859
Result
Threat name:
CryptOne, SystemBC
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1043643
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (may stop execution after checking mutex)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Yara detected SystemBC
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc/
Threat name:
Win32.Trojan.CobaltStrike
Create hunting rule
Status:
Malicious
First seen:
2022-07-24 00:46:12 UTC
File Type:
PE (Exe)
Extracted files:
40
AV detection:
22 of 25 (88.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=h25tcgp5wjhhnmus2sjdwmkttjv7buj6nl6xy362fdigej2ozdoa._file
Verdict:
malicious
Result
Malware family:
systembc
Create hunting rule
Score:
  10/10
Tags:
family:systembc trojan
Link:
https://tria.ge/reports/220730-z7a1hsgfh5/
Behaviour
Suspicious use of WriteProcessMemory
Drops file in Windows directory
SystemBC
Malware Config
C2 Extraction:
178.79.174.207:443
146.70.53.169:443
Unpacked files
SH256 hash:
c82329cc0d3880608ce9be0df600558301f51a2cbd69fe21c6ae719c0b5f823c
MD5 hash:
b1116d3ea7da617712b69a7fb8538681
SHA1 hash:
33ddf1f6cb90860d0db1b6f9283ac31d26ea6c77
Link:
https://www.unpac.me/results/baf9f926-0dc7-48f8-b68e-ccccc4e175ae/
SH256 hash:
3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc
MD5 hash:
54537dfa5c2f6dc982f4f62743825d59
SHA1 hash:
c17e4566a2b04520812943be13d1d96a711eaebe
Link:
https://www.unpac.me/results/baf9f926-0dc7-48f8-b68e-ccccc4e175ae/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3ebb3119fdb2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3ebb3119fdb24e76b292d4923b31539a6bf0d13e6afd7c6fda28d062274ec8dc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:EXT_MAL_SystemBC_Mar22_1
Create hunting rule
Author:Thomas Barabosch, Deutsche Telekom Security
Description:Detects unpacked SystemBC module as used by Emotet in March 2022
Reference:https://twitter.com/Cryptolaemus1/status/1502069552246575105
Rule name:MALWARE_Win_EXEPWSH_DLAgent
Create hunting rule
Author:ditekSHen
Description:Detects SystemBC
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:Start2_net_bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:Start2_net_mem
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:Start2_overlap_bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:Start2_overlap_mem
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:Start2__bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:SystemBC_Config
Create hunting rule
Author:@bartblaze
Description:Identifies SystemBC RAT, decrypted config.
Rule name:SystemBC_Socks
Create hunting rule
Author:@bartblaze
Description:Identifies SystemBC RAT, Socks proxy version.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/295289/

Comments