MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e21f50a1794acd0a585c86a157e8f70b044adcc860d6d0648d874deccd7ba653. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SystemBC

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	e21f50a1794acd0a585c86a157e8f70b044adcc860d6d0648d874deccd7ba653
SHA3-384 hash:	5870fd0edb5bd6c4dee585cd512ccabd06cf315c6a3c9c2f00e686dae7904128b0811b2f2319b375414220da2f2694e2
SHA1 hash:	cb908d0360486cbd37b9305fd0e918c66b5eb1f2
MD5 hash:	b5299c6348f7c4e483e5a41ce4c12c5a
humanhash:	wisconsin-hydrogen-hamper-uranus
File name:	b5299c6348f7c4e483e5a41ce4c12c5a.exe
Download:	download sample
Signature	SystemBC Create hunting rule
File size:	5'400'888 bytes
First seen:	2023-01-24 08:01:18 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ab329f8f72fc310f12d40c1ee53207e9 (1 x SystemBC, 1 x RaccoonStealer, 1 x Arechclient2)
ssdeep	98304:Ads6yt4oNzFOsjMW/N3F6WX5fAwk7JKiDFTHdieqewuntEmkhX:QylzFFTF6WpfAhQedBZnamq
Threatray	62 similar samples on MalwareBazaar
TLSH	T18F4612B697E212C7E8715D35C723BEB431723ECA96C1ACB566C8B99C04311D9E31B82D
TrID	42.7% (.EXE) Win32 Executable (generic) (4505/5/1) 19.2% (.EXE) OS/2 Executable (generic) (2029/13) 19.0% (.EXE) Generic Win/DOS Executable (2002/3) 18.9% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):
dhash icon	31f0c0b2b2c0f071 (8 x Formbook, 7 x AgentTesla, 4 x AsyncRAT)
Reporter	abuse_ch
Tags:	exe SystemBC

Intelligence

File Origin

# of uploads :

# of downloads :

227

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

b5299c6348f7c4e483e5a41ce4c12c5a.exe

Verdict:

No threats detected

Analysis date:

2023-01-24 08:06:33 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/7c0aabae-d2fc-4870-bcde-2ef2a98eb692

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

SystemBC

Link:

https://www.capesandbox.com/analysis/356263/

Result

Verdict:

Clean

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Creating a window

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/62690/overview

Behaviour

MalwareBazaar

Verdict:

Unknown

Threat level:

n/a -.1/10

Confidence:

100%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/63cf907c528134caf0431f87/reports/3b5bac58-f6da-4ddb-9441-da20e65cb6a1/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/958b22ee-f13b-4309-8cd1-f4410e385fc3

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1157689

Signature

Hides threads from debuggers

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Query firmware table information (likely to detect VMs)

Tries to detect virtualization through RDTSC time measurements

Tries to evade analysis by execution special instruction (VM detection)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e21f50a1794acd0a585c86a157e8f70b044adcc860d6d0648d874deccd7ba653/

Gathering data

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4ipvbilzjlgquwc4q2qvp2hxbmcevxgimdlnazenq5g6ztl3uzjq._file

Verdict:

malicious

SystemBC

65f908a0dfe5c343457bab4b68004a1b5fceb4e89c28c263ec05479eae182e9a

SystemBC

81074c41b76fd86ce228d266821c33d86a7448f30f58966d7990b77ba321552e

SystemBC

8e7d62f065db87ae8a824816af5447845b4f1fdd02d97f759f251f0e1254f5c3

SystemBC

8facf32116a5f68467c71032d3a207abaa20fbcc56fcab6a3db650b4d30ad115

SystemBC

aa5e9ff271143c3cd205988c3100f1bb844d70d2930f04a2b2002e9c0951a74e

SystemBC

bb245b05ff105192f4e01b4a1fbdb41f5144d4d32392885323ad241ad50a6596

SystemBC

dbf55407956dcd3184bce35b35697a073f5fa51b6fcb7713e9aef81fa9511ec6

SystemBC

+ 52 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

5/10

Tags:

n/a

Link:

https://tria.ge/reports/230124-jw4wfsbf6s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of NtSetInformationThreadHideFromDebugger

Unpacked files

SH256 hash:

e21f50a1794acd0a585c86a157e8f70b044adcc860d6d0648d874deccd7ba653

MD5 hash:

b5299c6348f7c4e483e5a41ce4c12c5a

SHA1 hash:

cb908d0360486cbd37b9305fd0e918c66b5eb1f2

Link:

https://www.unpac.me/results/e3f8ef13-9efa-4b65-8023-c6bd13344896/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e21f50a1794acd0a585c86a157e8f70b044adcc860d6d0648d874deccd7ba653

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Start2__bin Create hunting rule
Author:	James_inthe_box
Description:	SystemBC
Reference:	7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e