ewterz Threat Alert –SystemBC Malware – Active IOCs

Severity

High

Analysis Summary

SystemBC malware is a proxy Trojan that allows attackers to route network traffic through infected systems and hide their origin. It is often used in conjunction with other malicious software, such as banking Trojans, ransomware, and spyware, to carry out various types of cyber attacks. The malware is primarily spread through malicious email attachments, exploiting vulnerabilities in software, or via drive-by downloads from compromised websites. Once installed on a system, SystemBC can run in the background and provide a foothold for further exploitation.

SystemBC has been found to use several methods of persistence, including the creation of registry entries, scheduled tasks, and the use of hidden files. The malware can also gather information about the infected system, such as installed software, system settings, and user data, which is then transmitted back to the attacker’s command and control server. In terms of its behavior, SystemBC is designed to be stealthy and evade detection by security software. It can dynamically change its behavior to avoid detection, and it can also use encryption and other obfuscation techniques to hide its communication with the command and control server.

To protect against SystemBC and other types of malware, users are advised to keep their operating system and software up to date, avoid suspicious attachments or links in emails, and run security software on their computers. If you suspect that your system has been infected, it is recommended that you seek assistance from a security professional to remove the infection and secure your system.

Impact

• Credential Theft
• Information Theft
• Financial Loss

Indicators of Compromise

MD5

• 250ed5825f166ce3037408aad1279687
• 8935e77a0d58fd07dbe8e094c6bacf6f
• f6027fb8824e1c97d7751e97d3d5794f
• e4b306658c26422c3734e38fe35f3901

SHA-256

• 9b61ab1b854861a9e98bc354da2b104c277c97fd758e39a24c382a9b06e29bc9
• eec99e0b7313623ce4bb15305166368bf658ae385f915c1993ca9f24660e196b
• e63a911ace589c223d9a5742a0813a8acfe6a07f1d6a569a93f00e3f4d9f3583
• ae16c9b0453f3cd9829140adcf38934bc8e2497373e1f3ff486c351ae5b1118e

SHA-1

• 793029f350ebf293cd693ac271cfec186a8c78d3
• eb2616d7fbe11f4540f04025e686a3236dace506
• e27ca84e11313e7cb2989a2bc96251b2f614f25a
• 1e6cfab2ead962d98819ebb39df2f74cb4ede975

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Patch and upgrade any platforms and software timely and make it into a standard security policy.
• Prioritize patching known exploited vulnerabilities and zero-days. Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.
• Do not open emails and attachments from unknown or suspicious sources.