MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60ac80da516e77efa3c2bd15a97768ad1535ec456ca8dccbdcf75b4c404fd591. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SystemBC


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60ac80da516e77efa3c2bd15a97768ad1535ec456ca8dccbdcf75b4c404fd591
SHA3-384 hash: fe1c8091d252c2aba305b3c5b7efd65785cebea26ebe77a300b225c5f748730a8eefd09ba79dd1a6c1a0397a3aeb30f4
SHA1 hash: ef6b3e136a55f6d96ad8af38e9676df955975055
MD5 hash: b803593f93796171cf128e2d282ac0ff
humanhash: delaware-spring-harry-lemon
File name:b803593f93796171cf128e2d282ac0ff.exe
Download: download sample
Signature SystemBC
Create hunting rule
File size:232'512 bytes
First seen:2020-08-03 06:58:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1ea44259fa1e7df99bf96722ac9d94b2 (2 x SystemBC)
ssdeep 3072:+Ct0LtnmuoOtv5wgXlw1xZWaDWAuFpqtO7PgeBRZVfKSWLw5z0jZqMNM/yn3:+O2QvgXsgNbqt2P7ZFDr4vMW3
Threatray 1'219 similar samples on MalwareBazaar
TLSH E5344CE6F0C5ED7DD6D24AB64C19E53B499E5EFE98E32A5C00E0F200F9B53E80019E95
Reporter abuse_ch
Tags:exe SystemBC

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/37398/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Enabling autorun by creating a file
Sending an HTTP GET request to an infection source
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/407313
Signature
Connects to many ports of the same IP (likely port scanning)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
May check the online IP address of the machine
May use the Tor software to hide its network traffic
Tries to detect virtualization through RDTSC time measurements
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60ac80da516e77efa3c2bd15a97768ad1535ec456ca8dccbdcf75b4c404fd591/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 05:38:49 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mcwibwsrnz367i6cxuk2s53ivuktl3cfnsunzs6465nuyqcp2wiq._file
Verdict:
malicious
Similar samples:
0875edde82d686305c4a1bfdb0fc8ca30551971789ba581622b7106f142c903a
SystemBC
2000a32ad4e07b435995d624b4406ed34700f0754040a36ad3bbc8190f9c9495
SystemBC
20354da385cfab5a5c82e9b8398becf43eba43b93b48f97a64b4560a04a2012b
SystemBC
402ca92c8036b0efe01f337030413334943bf1c6965a22df9f6510daa5627e42
SystemBC
7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91
SystemBC
93c54da7adbb2872bb4fd20d4ba4a2ad0156437c49d2a2c63bd2d3411c25030f
SystemBC
990edaa15e1079b642d834178a84a2c0ae450ba0451a9aa5893dc4681a75391b
SystemBC
cb80e06d93b7cdd7741f2b35ea7bc187bb941ea6ad7e7b8a569caccc8cffb59e
SystemBC
f7fa245bde0a4d482ee5164097fc98d55e27beced21aae0199b1b1dfb367b753
SystemBC
febba30f2321bffeee1f57eacc46fef35eac9d7f9745125c64efee1c0d4cd4e2
SystemBC
+ 1'209 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/200803-sqkd9cf63x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Drops file in Windows directory
Drops file in Windows directory
Looks up external IP address via web service
Looks up external IP address via web service
Executes dropped EXE
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/60ac80da516e77efa3c2bd15a97768ad1535ec456ca8dccbdcf75b4c404fd591

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Datper
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Datper in memory
Reference:https://blogs.jpcert.or.jp/en/2017/08/detecting-datper-malware-from-proxy-logs.html
Rule name:Rooter
Create hunting rule
Author:Seth Hardy
Description:Rooter
Rule name:RooterStrings
Create hunting rule
Author:Seth Hardy
Description:Rooter Identifying Strings
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/37398/

Comments