Rewterz Threat Alert – SystemBC Malware – Active IOCs

Severity

High

Analysis Summary

SystemBC malware is a proxy Trojan that allows attackers to route network traffic through infected systems and hide their origin. It is often used in conjunction with other malicious software, such as banking Trojans, ransomware, and spyware, to carry out various types of cyber attacks. The malware is primarily spread through malicious email attachments, exploiting vulnerabilities in software, or via drive-by downloads from compromised websites. Once installed on a system, SystemBC can run in the background and provide a foothold for further exploitation.

SystemBC has been found to use several methods of persistence, including the creation of registry entries, scheduled tasks, and the use of hidden files. The malware can also gather information about the infected system, such as installed software, system settings, and user data, which is then transmitted back to the attacker’s command and control server. In terms of its behavior, SystemBC is designed to be stealthy and evade detection by security software. It can dynamically change its behavior to avoid detection, and it can also use encryption and other obfuscation techniques to hide its communication with the command and control server.

To protect against SystemBC and other types of malware, users are advised to keep their operating system and software up to date, avoid suspicious attachments or links in email, and run security software on their computers. If you suspect that your system has been infected, it is recommended that you seek assistance from a security professional to remove the infection and secure your system.

Impact

• Credential Theft 
• Information Theft 
• Financial Loss

Indicators of Compromise

MD5

• aa6f1c111191b58f7c606f8b4493bd5c
• 44c9814d3dba7526300bfee720853ea2
• a3c0b5b15a50254c4d72412e4bff4b6b
• c27a70d2ef4fe2df33ecb129ea7de076

SHA-256

• c700525de4c86440dd87d3b66453796a7633d904000e88d937c908941f0b9a17
• 6fe218dea5435f56596a29a9d68614b9d4eb7615bb216897cced2d1aec586431
• 6151029645e6e1664322c0154bf61aca01a5576394f338fb7970dfb5785403b4
• 5ec8727b7a40b84c954d30774eab88e327191a6171d4881544f5486be806421d

SHA-1

• d8e6d1b8186ef7dda0a088fdc374f1370a77c091
• ec239ce6d39a144a7a78aa623298e756548f1634
• d4a21c77f295aaf4f9cf5d63ff699b5e51ac5f3d
• 519de3af608688ea674c39b08156a629645bfb17

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Patch and upgrade any platforms and software timely and make it into a standard security policy.
• Prioritize patching known exploited vulnerabilities and zero-days. Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets.
• Do not open emails and attachments from unknown or suspicious sources.