MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b63632d26f9c84bc2d934295c3d5fb996ed26bd4abc79370e565ddfcdcc295a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SystemBC


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b63632d26f9c84bc2d934295c3d5fb996ed26bd4abc79370e565ddfcdcc295a
SHA3-384 hash: bd1a1ef9d9172e16b6ccda1fa4617e2f3e344f0f78a816d518eafe998daee5cc97e2ec6f4f4842516fae4a4750ba30d6
SHA1 hash: be4384d7daf5f5223f053a4bf709577940f4aeab
MD5 hash: 5e927645b944c049a6c8873bcd14b6cf
humanhash: edward-maine-hamper-oscar
File name:5e927645b944c049a6c8873bcd14b6cf.exe
Download: download sample
Signature SystemBC
Create hunting rule
File size:263'680 bytes
First seen:2022-07-04 17:50:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 47a65835858de3283b792cf915c137ce (1 x Loki, 1 x Smoke Loader, 1 x SystemBC)
ssdeep 6144:LZLMmwvJKuNbOEVJr7IuaDrV11ro+FSVgQIa2ge:LZw1JKuNVjr7+nVfroLVgQs
TLSH T135447C10BBA0D035F1F742F449BA83687A3EBAA15B3490CB66D417ED56396E4EC3035B
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 2dec1370399b9b91 (25 x RedLineStealer, 21 x Smoke Loader, 8 x ArkeiStealer)
Reporter abuse_ch
Tags:exe SystemBC


Avatar
abuse_ch
SystemBC C2:
5.61.41.136:4236

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
5.61.41.136:4236 https://threatfox.abuse.ch/ioc/787254/

Intelligence

File Origin
# of uploads :
1
# of downloads :
278
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file
Launching the default Windows debugger (dwwin.exe)
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
azorult greyware packed systembc
Link:
https://www.filescan.io/uploads/62c3288698766731ae82b60e/reports/dac69fd5-1171-4126-8ec0-45eacd06fd0c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
SystemBC
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d5a68d60-088d-427f-8e58-0b16da2682c3
Result
Threat name:
SystemBC
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1024354
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (may stop execution after checking mutex)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected SystemBC
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b63632d26f9c84bc2d934295c3d5fb996ed26bd4abc79370e565ddfcdcc295a/
Threat name:
Win32.Backdoor.Systembc
Create hunting rule
Status:
Malicious
First seen:
2022-06-22 05:26:52 UTC
File Type:
PE (Exe)
Extracted files:
10
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jnrwgljg7heexqwzgquvypk7xglo2jv5jk6hsnyokzo57tomffna._file
Verdict:
malicious
Result
Malware family:
systembc
Create hunting rule
Score:
  10/10
Tags:
family:systembc trojan
Link:
https://tria.ge/reports/220704-we5gwacec7/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
SystemBC
Malware Config
C2 Extraction:
5.61.41.136:4236
5.61.41.225:4236
Unpacked files
SH256 hash:
ac5d1a7927f227fff78750bb06069f1d7aa3bc44591ccb544e646c2814bf5307
MD5 hash:
6b503ce4dfaf8a2a9c899f6a49d407b0
SHA1 hash:
f27b6358c26eadb6036243c3c2bc0182417d9635
Link:
https://www.unpac.me/results/6353173f-f693-4e2b-8c7a-9ce7ffdc04de/
SH256 hash:
4b63632d26f9c84bc2d934295c3d5fb996ed26bd4abc79370e565ddfcdcc295a
MD5 hash:
5e927645b944c049a6c8873bcd14b6cf
SHA1 hash:
be4384d7daf5f5223f053a4bf709577940f4aeab
Link:
https://www.unpac.me/results/6353173f-f693-4e2b-8c7a-9ce7ffdc04de/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:EXT_MAL_SystemBC_Mar22_1
Create hunting rule
Author:Thomas Barabosch, Deutsche Telekom Security
Description:Detects unpacked SystemBC module as used by Emotet in March 2022
Reference:https://twitter.com/Cryptolaemus1/status/1502069552246575105
Rule name:MALWARE_Win_EXEPWSH_DLAgent
Create hunting rule
Author:ditekSHen
Description:Detects SystemBC
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Start2_net_bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:Start2_overlap_bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:Start2__bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:SystemBC_Config
Create hunting rule
Author:@bartblaze
Description:Identifies SystemBC RAT, decrypted config.
Rule name:SystemBC_Socks
Create hunting rule
Author:@bartblaze
Description:Identifies SystemBC RAT, Socks proxy version.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments