socks5systemz

General

Target
c7d51a729ff97c971e387c5c4d6df5c6b5dbaf68c4c594f37578086d69667323
Size 1.8MB
Sample240331-e8ed4sed79
SHA256 c7d51a729ff97c971e387c5c4d6df5c6b5dbaf68c4c594f37578086d69667323
MD5 557f1e39e968eaebf79d02cf839d5dde
SHA1 2d8bc0386e971ec0c6aa875c7ca9d02e2217b9cf
SHA512 0ac69eacc2ce2e7fcb9e38890085f35213b3978d8e316ee3e5661a4415360f52c93ce6cabe2b349a156a22c2fcb9316308b1739ef4ed15da4e0f18de246c09e9
SSDEEP 49152:32ucBtiWLEeLxUJeRK87Z6ljmQTRf6TOWfX67Kw:mFBieeeRK87wdLTRf66SXKKw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

http://bxdezob.com/search/?q=67e28dd83d0ef479150af9197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4be8889b5e4fa9281ae978a571ea771795af8e05c645db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ffe19c5e69d9e3c
http://bxdezob.com/search/?q=67e28dd83d0ef479150af9197c27d78406abdd88be4b12eab517aa5c96bd86ee918e4d855a8bbc896c58e713bc90c91e36b5281fc235a925ed3e06d6bd974a95129070b616e96cc92be510b866db51b9e34eed4c2b14a82966836f23d7f210c7ee94923ec4679211

Targets

- Target
  c7d51a729ff97c971e387c5c4d6df5c6b5dbaf68c4c594f37578086d69667323
- Size 1.8MB
- SHA256 c7d51a729ff97c971e387c5c4d6df5c6b5dbaf68c4c594f37578086d69667323
- MD5 557f1e39e968eaebf79d02cf839d5dde
- SHA1 2d8bc0386e971ec0c6aa875c7ca9d02e2217b9cf
- SHA512 0ac69eacc2ce2e7fcb9e38890085f35213b3978d8e316ee3e5661a4415360f52c93ce6cabe2b349a156a22c2fcb9316308b1739ef4ed15da4e0f18de246c09e9
- SSDEEP 49152:32ucBtiWLEeLxUJeRK87Z6ljmQTRf6TOWfX67Kw:mFBieeeRK87wdLTRf66SXKKw
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2