MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8dc6a4ee7b41ba73197485e2b685f7f82e9889b2e544269eabcc5c6c1cb8bac7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SystemBC

Vendor detections: 13

Intelligence 13 IOCs 1 YARA 9 File information Comments 1

SHA256 hash:	8dc6a4ee7b41ba73197485e2b685f7f82e9889b2e544269eabcc5c6c1cb8bac7
SHA3-384 hash:	baa5066ecb2d51b15f7119f3b17b61b41158d9c254a6114f584dd130554e2834b63fa54d3f00f0ed67ee1db88d2b3ad0
SHA1 hash:	92d942f9eba3c7146588f56d33a32262e042091d
MD5 hash:	1be6092e32956e83b99c3dc7c66603c7
humanhash:	west-early-mountain-missouri
File name:	1be6092e32956e83b99c3dc7c66603c7
Download:	download sample
Signature	SystemBC Create hunting rule
File size:	13'824 bytes
First seen:	2022-09-12 01:49:06 UTC
Last seen:	2022-09-21 02:38:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	801793b2be29822524e8824fc3c47535 (31 x SystemBC)
ssdeep	192:6kWjQTlZ1eB+pvdNtj2+SPwHP+Q/ZCv2qwvuCKK76n9bJHOkrUNn:6kjTlZ02NtvSKP+cZC+qwZPGn9bJrUN
Threatray	217 similar samples on MalwareBazaar
TLSH	T17652E7D734618D65C016C6B07E6FA320D4BE6575153A9438EFE00F28773EAA3DB2271A
TrID	54.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 18.3% (.EXE) Win64 Executable (generic) (10523/12/4) 8.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.8% (.EXE) Win32 Executable (generic) (4505/5/1) 3.5% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	zbetcheckin
Tags:	32 exe SystemBC

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
31.41.244.183:4257	https://threatfox.abuse.ch/ioc/849235/

Intelligence

File Origin

# of uploads :

# of downloads :

359

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

systembc

ID:

File name:

1be6092e32956e83b99c3dc7c66603c7

Verdict:

Malicious activity

Analysis date:

2022-09-12 01:51:08 UTC

Tags:

systembc

Link:

https://app.any.run/tasks/a1e81cfb-72ca-4ec0-b7e6-3f21d91be63c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/309390/

Detection(s):

Win.Malware.Doina-9878360-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

Creating a file

Sending a custom TCP request

Enabling autorun by creating a file

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/37422/overview

Behaviour

MalwareBazaar

CheckCmdLine

CheckMutex

WindowsNumberSmall

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware shell32.dll systembc threat

Link:

https://www.filescan.io/uploads/631e9090fec190e8fc3dcb06/reports/ec38c422-0ca2-4ff6-a041-2f17328cc610/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

SystemBC

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/aedce47b-13be-4e27-a60f-401e6e2b4195

Result

Threat name:

SystemBC

Detection:

malicious

Classification:

troj

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1068582

Signature

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected SystemBC

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8dc6a4ee7b41ba73197485e2b685f7f82e9889b2e544269eabcc5c6c1cb8bac7/

Threat name:

Win32.Backdoor.Coroxy

Status:

Malicious

First seen:

2022-09-08 15:28:19 UTC

File Type:

PE (Exe)

AV detection:

23 of 26 (88.46%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rxdkj3t3ig5hggluqxrlnbpx7axjrcns4vccnhvlzrogyhfyxldq._file

Verdict:

malicious

SystemBC

595e1545c53d27fb1315e70b241e66f44b28a49be59a717ca4936d167e121470

SystemBC

8e83317b3259203394616c5ea47f4907c9680af69e34c0242af1052230c1e295

SystemBC

8f620e963130716ac09ba5a7c75d7e7ea42ac1a4b66fc0a106e6feb40941fe23

SystemBC

ab971c45e2e31f860ac74d476aee2aeb850a5f4130ca12c6c8110e8c4621aca9

SystemBC

c9dc59066fe4cd939a7c33572a4db6918e18e1abc76c897abd39b127e7575e18

SystemBC

d3799efc3b84bbb7f8a7d7eb977de54e94da35d5c84616f8b91745b3c710e491

SystemBC

fe6d6d15e0ffa8717c2a5ac80b7f117e853c05cd642c746bb2eab0f70416150d

SystemBC

+ 207 additional samples on MalwareBazaar

Result

Malware family:

systembc

Score:

10/10

Tags:

family:systembc

Link:

https://tria.ge/reports/220912-b89ngacdg4/

Behaviour

Suspicious use of WriteProcessMemory

Drops file in Windows directory

Malware Config

C2 Extraction:

31.41.244.183:4257
194.36.177.46:4257

Verdict:

Unknown

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/8461f91d-ea7b-4f49-b9a9-e9f84d74aec4

Unpacked files

SH256 hash:

8dc6a4ee7b41ba73197485e2b685f7f82e9889b2e544269eabcc5c6c1cb8bac7

MD5 hash:

1be6092e32956e83b99c3dc7c66603c7

SHA1 hash:

92d942f9eba3c7146588f56d33a32262e042091d

Link:

https://www.unpac.me/results/7a097170-287c-498c-bb31-80badc92ef12/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.45

Link:

https://yomi.yoroi.company/submissions/8dc6a4ee7b41ba73197485e2b685f7f82e9889b2e544269eabcc5c6c1cb8bac7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	EXT_MAL_SystemBC_Mar22_1 Create hunting rule
Author:	Thomas Barabosch, Deutsche Telekom Security
Description:	Detects unpacked SystemBC module as used by Emotet in March 2022
Reference:	https://twitter.com/Cryptolaemus1/status/1502069552246575105

Rule name:	MALWARE_Win_EXEPWSH_DLAgent Create hunting rule
Author:	ditekSHen
Description:	Detects SystemBC

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	Start2_net_bin Create hunting rule
Author:	James_inthe_box
Description:	SystemBC
Reference:	7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e

Rule name:	Start2_overlap_bin Create hunting rule
Author:	James_inthe_box
Description:	SystemBC
Reference:	7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e

Rule name:	Start2__bin Create hunting rule
Author:	James_inthe_box
Description:	SystemBC
Reference:	7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e

Rule name:	SystemBC_Config Create hunting rule
Author:	@bartblaze
Description:	Identifies SystemBC RAT, decrypted config.

Rule name:	SystemBC_Socks Create hunting rule
Author:	@bartblaze
Description:	Identifies SystemBC RAT, Socks proxy version.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SystemBC

exe 8dc6a4ee7b41ba73197485e2b685f7f82e9889b2e544269eabcc5c6c1cb8bac7

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/309390/

URLhaus

https://urlhaus.abuse.ch/url/2300025/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2022-09-12 01:49:13 UTC

url : hxxp://212.192.31.73:7777/inconiiiococowg.ru/BBBBBBBBBBBBBBBBBBBB.exe