MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e498a9bc5208447745cee34283c29c773650a9ce9a92717b2fb6385b5e54ed4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SystemBC

Vendor detections: 14

Intelligence 14 IOCs 1 YARA 12 File information Comments

SHA256 hash:	e498a9bc5208447745cee34283c29c773650a9ce9a92717b2fb6385b5e54ed4a
SHA3-384 hash:	3832c263f558aa29815b94d19424d5ef459d9bffff68aee0b9bc873a83ccefb7a41623997f0ea6aa707d7878071f6b9c
SHA1 hash:	651878888dfbc52dff55465424ef049cf31880e2
MD5 hash:	049dd0b594dd65f34d76321cc920f6c5
humanhash:	ack-magnesium-alaska-grey
File name:	049dd0b594dd65f34d76321cc920f6c5.exe
Download:	download sample
Signature	SystemBC Create hunting rule
File size:	175'104 bytes
First seen:	2022-08-05 06:20:19 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	927f18a9d3e2f571a51e8054d3985b4f (1 x Stop, 1 x SystemBC, 1 x RedLineStealer)
ssdeep	3072:C2xL6nWi0jL4kMxTIw5kmHGKIs60IUKAx1HC5xAeogFYl9OvqIp:/xL6nWi0jL4jZICkmHGKb60dxZe2eFO9
Threatray	121 similar samples on MalwareBazaar
TLSH	T1F604AD2137E1C43DF1A716305870C2A2EA7BB81267B1818B7764163A5E332D06B79FDB
TrID	40.3% (.EXE) Win64 Executable (generic) (10523/12/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4505/5/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):
dhash icon	38b078cccacccc43 (123 x Smoke Loader, 83 x Stop, 63 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe SystemBC

abuse_ch

SystemBC C2:
http://213.170.133.189/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://213.170.133.189/	https://threatfox.abuse.ch/ioc/841455/

Intelligence

File Origin

# of uploads :

# of downloads :

256

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

systembc

ID:

File name:

049dd0b594dd65f34d76321cc920f6c5.exe

Verdict:

Malicious activity

Analysis date:

2022-08-05 06:22:29 UTC

Tags:

loader stealer systembc

Link:

https://app.any.run/tasks/e02da53e-65cb-4f41-aa47-286a9228dfab

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/296556/

Detection(s):

Win.Malware.Dropperx-9959775-0

Win.Malware.Generic-9959776-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending an HTTP POST request

Launching the default Windows debugger (dwwin.exe)

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/28101/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

EvasionGetTickCount

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware lockbit packed smoke

Link:

https://www.filescan.io/uploads/62ecb70ba405183f8ea518bc/reports/8351a4f5-f9fb-4a0d-ae45-4c808d238d56/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Raccoon Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c6827d09-d1df-49e3-b595-a547f71c692d

Result

Threat name:

Raccoon Stealer v2, SystemBC

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1046571

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected Raccoon Stealer v2

Yara detected SystemBC

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e498a9bc5208447745cee34283c29c773650a9ce9a92717b2fb6385b5e54ed4a/

Threat name:

Win32.Backdoor.Systembc

Status:

Malicious

First seen:

2022-08-02 17:35:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

32 of 39 (82.05%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=4smktpcsbbchoroo4nbihqu4o43fbkootkjhc6zpwy4fwxsu5vfa._file

Verdict:

malicious

Result

Malware family:

systembc

Score:

10/10

Tags:

family:raccoon family:systembc botnet:7098bc5fa66c4f7a1f57859717e93e66 discovery spyware stealer trojan

Link:

https://tria.ge/reports/220805-g4bhrsfhd4/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Drops file in Windows directory

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Executes dropped EXE

Raccoon

Raccoon Stealer payload

SystemBC

Malware Config

C2 Extraction:

http://213.170.133.189
http://213.170.133.190
193.106.191.168:4244
146.70.53.169:4244

Unpacked files

SH256 hash:

10c3141b2b49ea02c329ce85848d75a02cb919686920bb3c7df4b03a2794e082

MD5 hash:

4f83fbb77127e161d0a44f6ee75931cb

SHA1 hash:

28b95be656205afcf7661b0b7f6f1df23a810b5f

Link:

https://www.unpac.me/results/63017d68-7836-403d-9a9e-17a8f04d31aa/

SH256 hash:

e498a9bc5208447745cee34283c29c773650a9ce9a92717b2fb6385b5e54ed4a

MD5 hash:

049dd0b594dd65f34d76321cc920f6c5

SHA1 hash:

651878888dfbc52dff55465424ef049cf31880e2

Link:

https://www.unpac.me/results/63017d68-7836-403d-9a9e-17a8f04d31aa/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e498a9bc5208447745cee34283c29c773650a9ce9a92717b2fb6385b5e54ed4a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	EXT_MAL_SystemBC_Mar22_1 Create hunting rule
Author:	Thomas Barabosch, Deutsche Telekom Security
Description:	Detects unpacked SystemBC module as used by Emotet in March 2022
Reference:	https://twitter.com/Cryptolaemus1/status/1502069552246575105

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	MALWARE_Win_EXEPWSH_DLAgent Create hunting rule
Author:	ditekSHen
Description:	Detects SystemBC

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	pdb_YARAify Create hunting rule
Author:	@wowabiy314
Description:	PDB

Rule name:	RaccoonV2 Create hunting rule
Author:	@_FirehaK <yara@firehak.com>
Description:	This rule detects Raccoon Stealer version 2.0 (called Recordbreaker before attribution). It has been spotted spreading through fake software cracks and keygens as far back as April 2022.

Rule name:	Start2_net_bin Create hunting rule
Author:	James_inthe_box
Description:	SystemBC
Reference:	7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e

Rule name:	Start2_overlap_bin Create hunting rule
Author:	James_inthe_box
Description:	SystemBC
Reference:	7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e

Rule name:	Start2__bin Create hunting rule
Author:	James_inthe_box
Description:	SystemBC
Reference:	7bd341488dc6f01a6662ac478d67d3cd8211cbf362994355027b5bdf573cc31e

Rule name:	SystemBC_Config Create hunting rule
Author:	@bartblaze
Description:	Identifies SystemBC RAT, decrypted config.

Rule name:	SystemBC_Socks Create hunting rule
Author:	@bartblaze
Description:	Identifies SystemBC RAT, Socks proxy version.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/296556/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample