MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 812d4d9446b7962344e389b9498d08dabce1c9113bb18f554633da7e5992c4a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SystemBC


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 812d4d9446b7962344e389b9498d08dabce1c9113bb18f554633da7e5992c4a3
SHA3-384 hash: b5551360f7a195647e234a3ff8ac0a3a24b7be4ba77ed96a4dfa62836662f6752280c3a511fb3992f3b8fabf35681307
SHA1 hash: d4a67f7d2ba92b349f6c383c5999f6cea9ec8624
MD5 hash: f57c480c9b55ab5009803301c65ddcc8
humanhash: delaware-maine-stream-louisiana
File name:f57c480c9b55ab5009803301c65ddcc8.exe
Download: download sample
Signature SystemBC
Create hunting rule
File size:1'014'784 bytes
First seen:2023-01-19 12:34:32 UTC
Last seen:2023-01-19 14:31:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 92c98556c0103feddd9baeb413d8446b (2 x Arechclient2, 2 x LaplasClipper, 1 x SystemBC)
ssdeep 12288:b+qLO1eZ8ud4Le0FVKFYtcbgHW8xJF5A7koWNEF9x3ROV0bZVFfThaHqjw2f7NiS:NLOLFoDBw0NjLf7QS
TLSH T17825F78576F296C3E5A7DA7027017B61B64719F34B26F5F68B3390402AF72244CA738B
TrID 42.7% (.EXE) Win32 Executable (generic) (4505/5/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 0045e15951d190a2 (3 x LaplasClipper, 2 x SystemBC, 1 x Amadey)
Reporter abuse_ch
Tags:exe SystemBC

Intelligence

File Origin
# of uploads :
2
# of downloads :
203
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f57c480c9b55ab5009803301c65ddcc8.exe
Verdict:
Malicious activity
Analysis date:
2023-01-19 12:41:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/507554ae-360c-453b-9423-32b33a2828ac

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SystemBC
Create hunting rule
Link:
https://www.capesandbox.com/analysis/354485/
Detection(s):
SecuriteInfo.com.Win32.Trojan-gen.28103.1064.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/61442/overview
Behaviour
MalwareBazaar
AntidebugCommonApi
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
No Threat
Threat level:
  2/10
Confidence:
67%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/63c938f80089af3e437fa398/reports/ca7bcd55-6601-4e04-a5e9-f92bcae049ee/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c4185717-cea0-4479-9061-7336ab311948
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1154617
Signature
Antivirus detection for URL or domain
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (creates a PE file in dynamic memory)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 787350 Sample: Wv4lhaEk76.exe Startdate: 19/01/2023 Architecture: WINDOWS Score: 100 42 Multi AV Scanner detection for domain / URL 2->42 44 Antivirus detection for URL or domain 2->44 46 Multi AV Scanner detection for dropped file 2->46 48 3 other signatures 2->48 7 Wv4lhaEk76.exe 19 2->7         started        12 redit.exe 2->12         started        14 redit.exe 2->14         started        process3 dnsIp4 32 193.168.49.8, 49706, 80 BEGET-ASRU Russian Federation 7->32 34 62.217.181.4, 49703, 49704, 49705 AZERONLINEAZ Russian Federation 7->34 26 C:\Users\user\AppData\...\payload[1].dat, PE32 7->26 dropped 28 C:\ProgramData\MicrosoftMT\redit.exe, PE32 7->28 dropped 50 Detected unpacking (creates a PE file in dynamic memory) 7->50 52 Creates HTML files with .exe extension (expired dropper behavior) 7->52 54 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 7->54 16 redit.exe 7->16         started        20 cmd.exe 1 7->20         started        file5 signatures6 process7 dnsIp8 30 212.118.36.165, 4193, 49707 CITYLAN-ASRU Russian Federation 16->30 36 Multi AV Scanner detection for dropped file 16->36 38 Machine Learning detection for dropped file 16->38 40 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 16->40 22 conhost.exe 20->22         started        24 reg.exe 1 1 20->24         started        signatures9 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/812d4d9446b7962344e389b9498d08dabce1c9113bb18f554633da7e5992c4a3/
Threat name:
Win32.Trojan.Casdet
Create hunting rule
Status:
Malicious
First seen:
2023-01-18 01:11:34 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qewu3fcgw6lcgrhdrg4utdii3k6odsirhoyy6vkggpnh4wmsysrq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/230119-psby6ach3z/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b497df0f-6ba7-4d84-b93f-897e780ac788
Unpacked files
SH256 hash:
812d4d9446b7962344e389b9498d08dabce1c9113bb18f554633da7e5992c4a3
MD5 hash:
f57c480c9b55ab5009803301c65ddcc8
SHA1 hash:
d4a67f7d2ba92b349f6c383c5999f6cea9ec8624
Link:
https://www.unpac.me/results/7f9ecb06-7be0-4b84-82c8-d0f438c44109/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/812d4d9446b7962344e389b9498d08dabce1c9113bb18f554633da7e5992c4a3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SystemBC

Executable exe 812d4d9446b7962344e389b9498d08dabce1c9113bb18f554633da7e5992c4a3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2512367/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/354485/

Comments