General

  • Target

    8bf313052e72722eccb805905e048882f3fa6a4b983ea8890ee91c5020207bcb

  • Size

    1.9MB

  • Sample

    240324-gh9hnsch3v

  • MD5

    bb62ded867e8f5367f02a831eecadf48

  • SHA1

    33efe234c0fd67c649425829c61796d3059fb13a

  • SHA256

    8bf313052e72722eccb805905e048882f3fa6a4b983ea8890ee91c5020207bcb

  • SHA512

    6694976710c4df360bc03661f72bb74cc2b1eba536dc168cbbe79022ec5beafdf44047d25a192788061d4ac5b214f2a9d0c83aaf0100e1db6fe5bdd336b73026

  • SSDEEP

    49152:324W3JIDS5vrfoOYFmaD9BW2QTQfzn343atpAupr0y:m4sT57oaaD9QMjpdpr0y

Malware Config

Extracted

Family

socks5systemz

C2

http://ezvibxd.ua/search/?q=67e28dd86c0ea7794406f94d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa44e8889b5e4fa9281ae978f671ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffe13c5e6919938

http://ezvibxd.ua/search/?q=67e28dd86c0ea7794406f94d7c27d78406abdd88be4b12eab517aa5c96bd86e490874896148ab2865b77f80ebad9cc0f7cb63037ed2ab423a4334383ba915d911ec07bb606a0708727e40ea678c45abbe74ffb0e2807e12571c17f3e83fe16c1ee979f32c96c95

Targets

    • Target

      8bf313052e72722eccb805905e048882f3fa6a4b983ea8890ee91c5020207bcb

    • Size

      1.9MB

    • MD5

      bb62ded867e8f5367f02a831eecadf48

    • SHA1

      33efe234c0fd67c649425829c61796d3059fb13a

    • SHA256

      8bf313052e72722eccb805905e048882f3fa6a4b983ea8890ee91c5020207bcb

    • SHA512

      6694976710c4df360bc03661f72bb74cc2b1eba536dc168cbbe79022ec5beafdf44047d25a192788061d4ac5b214f2a9d0c83aaf0100e1db6fe5bdd336b73026

    • SSDEEP

      49152:324W3JIDS5vrfoOYFmaD9BW2QTQfzn343atpAupr0y:m4sT57oaaD9QMjpdpr0y

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks