TR SystemBC Iocs 03_03_2021

malspam distributor TR began distributing SystemBC today, mixing it up from recent qakbot/icedid campaigns.

Sheet Xls: https://app.any.run/tasks/d96ec247-8f7e-4a66-b885-de94979618e0
Sheet Ssdeep: 1536:4GcKoSsxz1PDZLDZjlbR868O8KlVH3/7uDphYHceXVhca+fMHLtyeGxcl8OR4Piy:4GcKoSsxzNDZLDZjlbR868O8KlVH3/7o

SystemBC Bin: https://bazaar.abuse.ch/sample/aaf1787a98de070ce8b558155b7f9a36e779bc21552f8ae6b39fdab275d9f7c0/

Urls:
http://ppk02dmgmzj03dxekog.com/index.xls
http://uhfa02eknih03swzdku.com/index.xls
http://lic02uiccnh03nruvp.com/index.xls
http://etysu02scnabr03wzaxue.com/index.xls
http://inpa02lzjvt03anas.com/index.xls
http://dskl02touc03jeby.com/index.xls
http://cidn02mjco03pobx.com/index.xls
http://ououz02naba03oiyd.com/index.xls
http://hqcaz02egeq03bvmhm.com/index.xls
http://zkkn02lffiff03zkmh.com/index.xls

SystemBC C2: marchassl01.com