MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 492300a7101350cdd4dd8a2fbc62216532919cf3b35ba5016f7a54b81bc1d98f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SystemBC


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 492300a7101350cdd4dd8a2fbc62216532919cf3b35ba5016f7a54b81bc1d98f
SHA3-384 hash: ad18bac4b40077c628424af7b2ab9d8774ee7543ec2182425592d0abb6ddeedbed5878955ec73e6b5ccfad895a605cc8
SHA1 hash: aa21464853ce5790c81a52044a2b188d1f844047
MD5 hash: cb00c0664a222daf1fb7ffe9bc3a4cc3
humanhash: georgia-early-magnesium-lake
File name:socks32.exe
Download: download sample
Signature SystemBC
Create hunting rule
File size:10'752 bytes
First seen:2023-11-29 21:03:56 UTC
Last seen:2023-11-29 22:26:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d66000edfed0a9938162b2b453ffa516 (3 x SystemBC)
ssdeep 192:F8fzqMmTL+f6eeAY82mNZRZ1eLP/x1fkNvFCDko:F8GMmv+f6eX22RZ0LXTsN0ko
Threatray 14 similar samples on MalwareBazaar
TLSH T13B22D56B7861C0A2C353C5BF7B5F1721D27FE6B79270901ADFE00C607B35AA68B4610A
TrID 30.2% (.EXE) Win64 Executable (generic) (10523/12/4)
18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.9% (.EXE) Win32 Executable (generic) (4505/5/1)
5.9% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter 1ZRR4H
Tags:exe SystemBC

Intelligence

File Origin
# of uploads :
2
# of downloads :
348
Origin country :
CL CL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/461267/
Detection(s):
SecuriteInfo.com.Win32.BackdoorX-gen.6042.22430.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Gathering data
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/492300a7101350cdd4dd8a2fbc62216532919cf3b35ba5016f7a54b81bc1d98f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
SystemBC
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/91f2f1af-9d10-48be-bbba-f1b778621cea
Result
Threat name:
SystemBC
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1350176
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Creates autostart registry keys with suspicious values (likely registry only malware)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suspicious powershell command line found
Yara detected SystemBC
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1350176 Sample: socks32.exe Startdate: 29/11/2023 Architecture: WINDOWS Score: 96 27 Found malware configuration 2->27 29 Malicious sample detected (through community Yara rule) 2->29 31 Antivirus / Scanner detection for submitted sample 2->31 33 5 other signatures 2->33 6 socks32.exe 1 2->6         started        10 powershell.exe 11 2->10         started        12 powershell.exe 2->12         started        process3 dnsIp4 23 2.57.149.230, 4357, 49705, 49706 NETDESIGN-ZONEPL Russian Federation 6->23 35 Creates autostart registry keys with suspicious values (likely registry only malware) 6->35 14 socks32.exe 10->14         started        17 conhost.exe 10->17         started        19 socks32.exe 12->19         started        21 conhost.exe 12->21         started        signatures5 process6 dnsIp7 25 127.0.0.1 unknown unknown 14->25
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/492300a7101350cdd4dd8a2fbc62216532919cf3b35ba5016f7a54b81bc1d98f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/492300a7101350cdd4dd8a2fbc62216532919cf3b35ba5016f7a54b81bc1d98f/
Threat name:
Win32.Backdoor.Systembc
Create hunting rule
Status:
Malicious
First seen:
2023-11-29 21:04:03 UTC
File Type:
PE (Exe)
AV detection:
25 of 37 (67.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jerqbjyqcnim3vg5rix3yyrbmuzjdhhtwnn2kalppjklqg6b3ghq._file
Verdict:
malicious
Similar samples:
05e1e433970cd6b3e85edbb6aa9bb2a85a7505e6eeb2cdb0f243ecc71afdf431
SystemBC
08cb1432c512df0370577dc50549ad06f729858143017fe00f79fcb218872d01
SystemBC
11e8929787fbdedd91877fd5380cdf7fa6380d51a4ecc999ed475915fda8b657
SystemBC
1729faf82ded430ab520c6ebd82743abb231222a867329f5b15c2d01b7578016
SystemBC
3497c6a41705f4bec1ab8ad4f5cd77f983d7a080a546165804894128e4d7d2cf
SystemBC
47465ee8b98fdc4fb2e0764ae7e5d391a852de8c5dd9a2153d4d094e79769b18
SystemBC
492300a7101350cdd4dd8a2fbc62216532919cf3b35ba5016f7a54b81bc1d98f
SystemBC
9199144c5156434c69d008c19562f9f6cf851720598c6550bbc2fc1f93e743ad
SystemBC
+ 4 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/231129-zwkqksda78/
Behaviour
Adds Run key to start application
Unpacked files
SH256 hash:
492300a7101350cdd4dd8a2fbc62216532919cf3b35ba5016f7a54b81bc1d98f
MD5 hash:
cb00c0664a222daf1fb7ffe9bc3a4cc3
SHA1 hash:
aa21464853ce5790c81a52044a2b188d1f844047
Detections:
MALWARE_Win_EXEPWSH_DLAgent
Create hunting rule
Link:
https://www.unpac.me/results/942aaab4-f65d-4527-a96d-57770dae5dd8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/492300a7101350cdd4dd8a2fbc62216532919cf3b35ba5016f7a54b81bc1d98f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_EXEPWSH_DLAgent
Create hunting rule
Author:ditekSHen
Description:Detects SystemBC
Rule name:Start2_net_bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SystemBC

Executable exe 492300a7101350cdd4dd8a2fbc62216532919cf3b35ba5016f7a54b81bc1d98f

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/461267/
  
URLhaus
https://urlhaus.abuse.ch/url/2736377/
  
Delivery method
Distributed via web download

Comments