MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ff416db5447cbcb7da7a2c10b20e3ec47f315fa15184979ea86c4e7e039a4c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SystemBC


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8ff416db5447cbcb7da7a2c10b20e3ec47f315fa15184979ea86c4e7e039a4c2
SHA3-384 hash: 9a6ec66dd9b7f5eb822239c33304d698d553449aa1d0c6e13a263d78814669ff980b669a35058b19491c105fd48aad9b
SHA1 hash: a0c3ba7679a36976bbbbad6c08758054ba49af8b
MD5 hash: 63b509f4565ff9a05402b2b18083b53a
humanhash: orange-nitrogen-iowa-virginia
File name:63b509f4565ff9a05402b2b18083b53a.exe
Download: download sample
Signature SystemBC
Create hunting rule
File size:272'896 bytes
First seen:2022-06-17 09:37:01 UTC
Last seen:2022-06-17 10:48:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3215fae786e72310b15953e12ddd6b57 (10 x RedLineStealer, 1 x SystemBC)
ssdeep 6144:yH8IVk4Zehh58aShksd29V0mN1s0fVyQaUvPQP/s:yHhBSh59uksd2ku1sqQQ+8
TLSH T133448D10BB90C035F5B702F449B9A3A8B93E7EA15B2490CFA2D11EED5635AE5DC3035B
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 25ac1378319b9bb1 (1 x SystemBC)
Reporter abuse_ch
Tags:exe SystemBC


Avatar
abuse_ch
SystemBC C2:
69.46.15.147:4001

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
69.46.15.147:4001 https://threatfox.abuse.ch/ioc/715934/

Intelligence

File Origin
# of uploads :
2
# of downloads :
267
Origin country :
n/a
Vendor Threat Intelligence
Detection:
SystemBC
Create hunting rule
Link:
https://www.capesandbox.com/analysis/280940/
Detection(s):
SecuriteInfo.com.Trojan.Siggen18.6877.8781.28619.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Сreating synchronization primitives
Creating a file
Sending a custom TCP request
Launching the default Windows debugger (dwwin.exe)
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/21722/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionQueryPerformanceCounter
EvasionGetTickCount
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
azorult greyware packed
Link:
https://www.filescan.io/uploads/62ac4b7d5c08d80e8ed85f5a/reports/026a776f-827d-4cf5-adf3-ed0643376bd8/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
SystemBC
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/431f3e8c-47b3-439e-b24d-e2e915cb4153
Result
Threat name:
SystemBC
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1015062
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (may stop execution after checking mutex)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected SystemBC
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8ff416db5447cbcb7da7a2c10b20e3ec47f315fa15184979ea86c4e7e039a4c2/
Threat name:
Win32.Backdoor.Systembc
Create hunting rule
Status:
Malicious
First seen:
2022-06-08 18:32:32 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
24 of 26 (92.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r72bnw2ui7f4w7nhulaqwihd5rd7gfp2cumes6pkq3copybzutba._file
Result
Malware family:
systembc
Create hunting rule
Score:
  10/10
Tags:
family:systembc trojan
Link:
https://tria.ge/reports/220617-llhatabdel/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
SystemBC
Malware Config
C2 Extraction:
69.46.15.147:4001
Unpacked files
SH256 hash:
c169ed04bc56200d011ab9ba1c833be9ac9f4af825211fb2d906e3e302da1eb7
MD5 hash:
17ea800b9e45f68ddeda1c4b51349eb3
SHA1 hash:
4014b2b0f6060a6437a6889bfb45a05bb2234540
Link:
https://www.unpac.me/results/9859cb3d-99a0-40ae-ba4a-e283c7e0ab23/
SH256 hash:
8ff416db5447cbcb7da7a2c10b20e3ec47f315fa15184979ea86c4e7e039a4c2
MD5 hash:
63b509f4565ff9a05402b2b18083b53a
SHA1 hash:
a0c3ba7679a36976bbbbad6c08758054ba49af8b
Link:
https://www.unpac.me/results/9859cb3d-99a0-40ae-ba4a-e283c7e0ab23/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8ff416db5447cbcb7da7a2c10b20e3ec47f315fa15184979ea86c4e7e039a4c2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:EXT_MAL_SystemBC_Mar22_1
Create hunting rule
Author:Thomas Barabosch, Deutsche Telekom Security
Description:Detects unpacked SystemBC module as used by Emotet in March 2022
Reference:https://twitter.com/Cryptolaemus1/status/1502069552246575105
Rule name:MALWARE_Win_EXEPWSH_DLAgent
Create hunting rule
Author:ditekSHen
Description:Detects SystemBC
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Start2_net_bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:Start2_overlap_bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:Start2__bin
Create hunting rule
Author:James_inthe_box
Description:SystemBC
Reference:7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e
Rule name:SystemBC_Config
Create hunting rule
Author:@bartblaze
Description:Identifies SystemBC RAT, decrypted config.
Rule name:SystemBC_Socks
Create hunting rule
Author:@bartblaze
Description:Identifies SystemBC RAT, Socks proxy version.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/280940/

Comments