MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55adc49ba429634e444530da7db47d57a5b7dbae5288500fa19ba63adafc5204. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SystemBC


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55adc49ba429634e444530da7db47d57a5b7dbae5288500fa19ba63adafc5204
SHA3-384 hash: 39c17e5581bf93087a5809f9db6305cb328cf6b06454e6ce506f73f6fcfd1d1c1c0fcf207ce16e2ec4ea190d993f7164
SHA1 hash: 3254b750137308b1d02a3aa8287588daf398c4fd
MD5 hash: 1eedb37b2417d56905a41f187c5a287a
humanhash: april-arizona-twelve-summer
File name:1eedb37b2417d56905a41f187c5a287a.exe
Download: download sample
Signature SystemBC
Create hunting rule
File size:817'896 bytes
First seen:2022-10-13 11:51:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep 12288:3S7Oy90tWMskR4qxSsSkhFsChuqzOEzu4OYOMnpHXliRVe:vyxkR4gfkbKOECZYOMpHqVe
TLSH T1A505F192EA9818E6FD3C333014BB499619B23C775EB4456E324EF51648B3382457FE2E
TrID 38.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
13.0% (.EXE) Win64 Executable (generic) (10523/12/4)
8.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon f0f8f0f8f0f8f0f0 (2 x SystemBC)
Reporter abuse_ch
Tags:exe SystemBC

Intelligence

File Origin
# of uploads :
1
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Detection:
SystemBC
Create hunting rule
Link:
https://www.capesandbox.com/analysis/319904/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.62696407.20145.260.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% subdirectories
Launching a process
Creating a process with a hidden window
Running batch commands
Launching cmd.exe command interpreter
Using the Windows Management Instrumentation requests
Moving a file to the %temp% subdirectory
Creating a process from a recently created file
DNS request
Possible injection to a system process
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/42924/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
advpack.dll anti-vm overlay packed rundll32.exe setupapi.dll shell32.dll
Link:
https://www.filescan.io/uploads/6347fbe467135c9da246c539/reports/ddda3f43-b9d3-4793-a721-841a517e39e9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
SystemBC
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b38d3728-40c8-4373-a98e-51db545052e0
Result
Threat name:
SystemBC
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1089811
Signature
Creates processes via WMI
DLL reload attack detected
Drops PE files with a suspicious file extension
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Renames NTDLL to bypass HIPS
Sigma detected: Drops script at startup location
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected SystemBC
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 722422 Sample: iIWI2RzN8F.exe Startdate: 13/10/2022 Architecture: WINDOWS Score: 100 64 Malicious sample detected (through community Yara rule) 2->64 66 Multi AV Scanner detection for submitted file 2->66 68 Yara detected SystemBC 2->68 70 2 other signatures 2->70 10 iIWI2RzN8F.exe 1 5 2->10         started        12 wscript.exe 2->12         started        15 GzbkShkBCI.exe.com 2->15         started        17 rundll32.exe 2->17         started        process3 signatures4 19 cmd.exe 1 10->19         started        22 ftp.exe 1 10->22         started        92 Creates processes via WMI 12->92 94 Multi AV Scanner detection for dropped file 15->94 process5 signatures6 72 Obfuscated command line found 19->72 74 Uses ping.exe to sleep 19->74 76 Drops PE files with a suspicious file extension 19->76 78 Uses ping.exe to check the status of other devices and networks 19->78 24 cmd.exe 2 19->24         started        28 conhost.exe 19->28         started        30 PING.EXE 1 19->30         started        32 conhost.exe 22->32         started        process7 file8 54 C:\Users\user\AppData\...\Bridges.exe.pif, PE32 24->54 dropped 88 Obfuscated command line found 24->88 90 Uses ping.exe to sleep 24->90 34 Bridges.exe.pif 5 24->34         started        39 PING.EXE 1 24->39         started        41 tasklist.exe 1 24->41         started        43 4 other processes 24->43 signatures9 process10 dnsIp11 58 89.22.225.242, 4193, 49700 INETLTDTR Russian Federation 34->58 60 twRQkzXXDjhSMuPjOZYXW.twRQkzXXDjhSMuPjOZYXW 34->60 50 C:\Users\user\AppData\...behaviorgraphzbkShkBCI.exe.com, PE32 34->50 dropped 52 C:\Users\user\AppData\Local\...\IBWeb.dll, PE32 34->52 dropped 80 Multi AV Scanner detection for dropped file 34->80 82 DLL reload attack detected 34->82 84 Found API chain indicative of sandbox detection 34->84 86 2 other signatures 34->86 45 cmd.exe 2 34->45         started        62 192.168.2.1 unknown unknown 39->62 file12 signatures13 process14 file15 56 C:\Users\user\AppData\...behaviorgraphzbkShkBCI.url, MS 45->56 dropped 48 conhost.exe 45->48         started        process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/55adc49ba429634e444530da7db47d57a5b7dbae5288500fa19ba63adafc5204/
Threat name:
Win32.Backdoor.Systembc
Create hunting rule
Status:
Suspicious
First seen:
2022-10-12 19:21:46 UTC
File Type:
PE (Exe)
Extracted files:
50
AV detection:
18 of 41 (43.90%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kww4jg5effru4rcfgdnh3nd5k6s3pw5okkefad5btotdvwx4kica._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  10/10
Tags:
persistence
Link:
https://tria.ge/reports/221013-n1qa3scfdj/
Behaviour
Enumerates processes with tasklist
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
Suspicious use of NtCreateUserProcessOtherParentProcess
Unpacked files
SH256 hash:
1a2e8329a2f3255c06825aed711ae65ad476aef811b21737cbef1ccc451872aa
MD5 hash:
1dd1a9c59ff05cced864226e1d5e00bb
SHA1 hash:
528f9f4642c498c78d45f74b5e7712fca9eb1959
Link:
https://www.unpac.me/results/a147e34f-42ac-4446-8199-dfafb963a67a/
SH256 hash:
55adc49ba429634e444530da7db47d57a5b7dbae5288500fa19ba63adafc5204
MD5 hash:
1eedb37b2417d56905a41f187c5a287a
SHA1 hash:
3254b750137308b1d02a3aa8287588daf398c4fd
Link:
https://www.unpac.me/results/a147e34f-42ac-4446-8199-dfafb963a67a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
SystemBC
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/55adc49ba429634e444530da7db47d57a5b7dbae5288500fa19ba63adafc5204

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SystemBC

Executable exe 55adc49ba429634e444530da7db47d57a5b7dbae5288500fa19ba63adafc5204

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2355193/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/319904/

Comments