socks5systemz

General

Target
02c9d37b3eebbc186b6fc262cd929762.bin
Size 1.9MB
Sample240325-bc51eabf92
SHA256 76581ab84464dc02b617ca641192ccbe660e4d283eef32a33dc3d9d0840182f8
MD5 b0a783535ee4ded616628cab4395fdf2
SHA1 e7b416614c130817a035bd5b3fe51420b9c6e247
SHA512 1120f807110f1af1d1aeb4527bb699eb497000ac1c9b89579fe2fa2bbff67d99344527b3f1b98aa1c19fbd7add4095683667b86a10afc060f989f1582209632c
SSDEEP 49152:ybWNOBQeMNm45YNF2biQ1zYVT/PfUHReEdCOAevWj4m6Zj:ybaOOtjIF2bB1zYVrOReEdCOVd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

http://buzojyd.com/search/?q=67e28dd83f0fa47b1407ab4e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa44e8889b5e4fa9281ae978a271ea771795af8e05c642db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a668dfd19c5ec94
http://bwaobli.com/search/?q=67e28dd8685ff32d4309f94d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c642db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffe12c2e790983e
http://bwaobli.com/search/?q=67e28dd8685ff32d4309f94d7c27d78406abdd88be4b12eab517aa5c96bd86e99d8e45855a8bbc896c58e713bc90c91836b5281fc235a925ed3e54d6bd974a95129070b611e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee949939c56a9413

Targets

- Target
  13054d2dd86e9d9b7920a0172e9b40ee0409f4e21412ace7ce16160394b6e87d.exe
- Size 1.9MB
- SHA256 13054d2dd86e9d9b7920a0172e9b40ee0409f4e21412ace7ce16160394b6e87d
- MD5 02c9d37b3eebbc186b6fc262cd929762
- SHA1 492503ac894a9e9e78211cced39ed0b0052ad737
- SHA512 270dc2b769c094403d14777c42d13df23c666bfc868659bc7f81020ec95b338c766ea6a5836281951e69c59945db205e7afab9a6367d13de118dd97b1fec38f0
- SSDEEP 24576:320yWIKtk8hG3DLgGM+OGOBTYQ5BBdCHIMy9J9JnHYNOZZ6sN0zQeCpeJdU0y8vu:32etDGFM+2f7LDRkOZ/MCASu98
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2