MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f97d3a159c05ed13798178c697514769201a1484922b09fdd7d8e00517aa861. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SystemBC


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3f97d3a159c05ed13798178c697514769201a1484922b09fdd7d8e00517aa861
SHA3-384 hash: d5d06b0fa97b7750dd89f634de303d3e079336452c2aafaa1c012af7cdf100c6816f09b2f726d12188871d111f1cd779
SHA1 hash: 540cd841f100a79e60fa221d3e4383b81289c546
MD5 hash: 8b4486ad760aabc58c411c83bf922fd7
humanhash: social-florida-emma-social
File name:3f97d3a159c05ed13798178c697514769201a1484922b09fdd7d8e00517aa861
Download: download sample
Signature SystemBC
Create hunting rule
File size:32'768 bytes
First seen:2022-11-03 06:00:48 UTC
Last seen:2022-11-03 08:04:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash bf0c7df0c054c291d79bd1c72984352c (12 x SystemBC)
ssdeep 768:HqPzUdiJ8dayafVcCSWYVYnPrryFbnpoJo2TZKc6VFg:YLJ8dayaaupDobnpo2wZJ
Threatray 222 similar samples on MalwareBazaar
TLSH T125E219263850E5F0D9A185F07F6EA714D6BE78364229A82DEFD05E2473B1AD3E706207
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter JAMESWT_WT
Tags:exe SystemBC

Intelligence

File Origin
# of uploads :
2
# of downloads :
205
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
systembc
Create hunting rule
ID:
1
File name:
3f97d3a159c05ed13798178c697514769201a1484922b09fdd7d8e00517aa861
Verdict:
Malicious activity
Analysis date:
2022-11-03 06:06:06 UTC
Tags:
systembc
Link:
https://app.any.run/tasks/b297d4ef-7e47-47cd-bb37-4bfb0b01f1d5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/327613/
Detection(s):
SecuriteInfo.com.Trojan.Spynet.48.15999.7841.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Creating a file
Creating a process from a recently created file
Launching a process
Forced system process termination
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/47788/overview
Behaviour
MalwareBazaar
CallSleep
CheckCmdLine
WindowsNumberSmall
CheckMutex
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
evasive greyware hacktool shell32.dll
Link:
https://www.filescan.io/uploads/6363592073a0205b3f77880d/reports/a3843551-135c-4796-8a4e-2cde1159f041/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
SystemBC
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/102b3817-cf17-4b20-a47e-22e218bec01e
Result
Threat name:
SystemBC
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1104065
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after checking mutex)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May use the Tor software to hide its network traffic
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect virtualization through RDTSC time measurements
Yara detected SystemBC
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3f97d3a159c05ed13798178c697514769201a1484922b09fdd7d8e00517aa861/
Threat name:
Win32.Backdoor.Coroxy
Create hunting rule
Status:
Malicious
First seen:
2022-09-23 10:12:12 UTC
File Type:
PE (Exe)
AV detection:
37 of 41 (90.24%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h6l5hikzybpncn4yc6ggs5iuo2jadikijerlbh65pwhaaul2vbqq._file
Verdict:
malicious
Similar samples:
318e0bd67ccbf40f50b848831fb2885b161e68acdfaaa0c619c79b3912af2ecd
SystemBC
63e7464225916f05a6dc4576721fae7a3a449fdab81072f28ba9a4bf5e9a54f9
SystemBC
6f926dba86af8a16354de93668c5161973c5b62cbbf803997acd068eaea16648
SystemBC
7b8b1ed75224573e0ede38e9c7fc5b9bf5b46dba275b5e3d23f94acd4b1a7a11
SystemBC
91647ac947d5d5d3a0dc69e98070bfc2f9841d7839b579d69c524b02869a497f
SystemBC
94a24841df9e30fab797665446d3ebbf9af6c8157a99d4c3f7afbe64d58777c6
SystemBC
9e5f370201251e8dc138678f8e0d4f0bdd75e1353edcc77d41c8401621c2c671
SystemBC
e7174b9891b41bf0459fd6fe3f6ab5c63aa5ab4883b02d32325dd19f6d1ed71f
SystemBC
e86c00bb96428b8c113169da2c996f457ed22467c5ad998e87bb48b65e98ab36
SystemBC
f0562d49226fc4776a7991b14f43b2c7a572ae276adef3d3dc3678b8b0894401
SystemBC
+ 212 additional samples on MalwareBazaar
Result
Malware family:
systembc
Create hunting rule
Score:
  10/10
Tags:
family:systembc trojan
Link:
https://tria.ge/reports/221103-gqwlsahebk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Executes dropped EXE
SystemBC
Malware Config
C2 Extraction:
146.70.101.95:4001
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/46772ef9-1882-4a32-b453-68d8f25e4746
Unpacked files
SH256 hash:
3f97d3a159c05ed13798178c697514769201a1484922b09fdd7d8e00517aa861
MD5 hash:
8b4486ad760aabc58c411c83bf922fd7
SHA1 hash:
540cd841f100a79e60fa221d3e4383b81289c546
Detections:
SystemBC
Create hunting rule
win_systembc_g0
Create hunting rule
Link:
https://www.unpac.me/results/905ea37c-1983-4b52-9dc2-489f0a0abf3d/
Parent samples :
873a028cd3d8f457b4f7b8036afbc736466eade13f229b92ae4d9c67815da376
3f97d3a159c05ed13798178c697514769201a1484922b09fdd7d8e00517aa861
f8079d9eb143214a50b52500677a1f20cba2817178e2a8a40d4fb184f5d3ab3f
7880b2cd5384bf7c1c094d871947504df1eef7f29befa93fec72bbafc4fa8fa8
97da405a325218d5444e1cb07436a38d2efccf758808d1dd2aab84514d5204c0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/3f97d3a159c05ed13798178c697514769201a1484922b09fdd7d8e00517aa861

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:MALWARE_Win_EXEPWSH_DLAgent
Create hunting rule
Author:ditekSHen
Description:Detects SystemBC
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:MiniTor
Create hunting rule
Author:@bartblaze
Description:Identifies MiniTor implementation as seen in SystemBC and Parallax RAT.
Reference:https://news.sophos.com/en-us/2020/12/16/systembc/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/327613/

Comments