YARA · Telekom Security malware analysis

TELEKOM_SECURITY_Win_Systembc_20220311

Detects unpacked SystemBC module

Author: Thomas Barabosch, Deutsche Telekom Security
Date: 2022-03-11
Modified: 2022-03-13
Score / Quality: 75 / 70

What this rule detects

Detects unpacked SystemBC module

Associated malware family: Systembc.

Targets: Windows PE.

It defines 5 patterns (5 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Rule text not reproduced

This rule comes from Telekom Security malware analysis, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:

View the rule on GitHub Open the repository

References

https://medium.com/walmartglobaltech/inside-the-systembc-malware-as-a-service-9aa03afd09c6

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

c926338972be5bdfdd89574f3dc2fe4d4f70fd4e24c1c6ac5d2439c7fcc50db5

Licence & attribution

Author: Thomas Barabosch, Deutsche Telekom Security

Source repository: Telekom Security malware analysis @ 755efb6658

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 39e1a131-bd2c-56e9-961f-2b2c31f29e85

Metadata

sharing	TLP:WHITE
in_memory	True

Tags:FILE

MALPEDIA_Win_Systembc_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
TELEKOM_SECURITY_Get_Windows_Proxy_ConfigurationMetadata only
Suspicious / huntingTelekom Security malware analysis· Thomas Barabosch, Deutsche Telekom Security· 2022-01-14