Rewterz Threat Alert – SystemBC Malware – Active IOCs

Severity

High

Analysis Summary

SystemBC malware is a proxy Trojan that allows attackers to route network traffic through infected systems and hide their origin. It is often used in conjunction with other malicious software, such as banking Trojans, ransomware, and spyware, to carry out various types of cyber attacks. The malware is primarily spread through malicious email attachments, exploiting vulnerabilities in software, or via drive-by downloads from compromised websites. Once installed on a system, SystemBC can run in the background and provide a foothold for further exploitation.

SystemBC has been found to use several methods of persistence, including the creation of registry entries, scheduled tasks, and the use of hidden files. The malware can also gather information about the infected system, such as installed software, system settings, and user data, which is then transmitted back to the attacker’s command and control server. In terms of its behavior, SystemBC is designed to be stealthy and evade detection by security software. It can dynamically change its behavior to avoid detection, and it can also use encryption and other obfuscation techniques to hide its communication with the command and control server.

To protect against SystemBC and other types of malware, users are advised to keep their operating system and software up to date, avoid suspicious attachments or links in email, and run security software on their computers. If you suspect that your system has been infected, it is recommended that you seek assistance from a security professional to remove the infection and secure your system.

Impact

• Credential Theft 
• Information Theft 
• Financial Loss

Indicators of Compromise

MD5

• 40753d4f4ba5863be3aaaa38cd50995a
• 4b8b7e4c7b2aed6c3c67b3d5678f6440
• a985b674e4b66b84636979d92733bf86
• 2579be109c1035cb96942951710020a8

SHA-256

• 23f66ece38393f81fc1f892c9243cebb6e5412b95629cc07fa83065f5b5a3e02
• dc23e92b35cd9ceb3e8adc91a4492facfd66d65f72967ba69c57f17470f9b66f
• 234097c41e0648bebb19dee2f2f3c841cb0beabb10c81916b1fcc3ff9ae0ab83
• a0a5ebd512b7685798ac966c0b05415df9eff585a79af11c9ff99d7aa17e2101

SHA-1

• cb58f6a57ecd27e7380e0f38dedb621d7d161e19
• 33097d2c883f7e8248c70876cfd6c77b36a1622a
• 3d12c15334752a71b53a2e78e08b92350f77d523
• 6987472967c8ce5e3d5fd6730a9da2964afacd10

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Patch and upgrade any platforms and software timely and make it into a standard security policy.
• Prioritize patching known exploited vulnerabilities and zero-days. Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets.
• Do not open emails and attachments from unknown or suspicious sources.