socks5systemz

General

Target
1e923e1a2c8ce0b65c27c7eb4486cce24f376300d98e5aa2ef5f60ce306a39dc
Size 1.8MB
Sample240331-et27madf3y
SHA256 1e923e1a2c8ce0b65c27c7eb4486cce24f376300d98e5aa2ef5f60ce306a39dc
MD5 3a73440f795448b96205196d56f69269
SHA1 035a826c7dddb53754523cc15ece9a0cad9e4e44
SHA512 a5cf48449eaff2b4113056512491ad2966a26193f3be83452fa539a8d8988312b2aaaa2c6d290dc5181ec76a06c611bc0f56db5084f9ada3f26c131e6db2f591
SSDEEP 49152:32OHOfqBhJP1w0oQ8dD9WxMs5KDAv4y1PNt7szni:mmp1ApdDwWkKDAAIPNt7szi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

http://ejhxooe.ua/search/?q=67e28dd86e58a42e450ca94d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ee8889b5e4fa9281ae978f671ea771795af8e05c646db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffe19c5e7909f3c
http://burewdi.com/search/?q=67e28dd83d0ef479150af9197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4be8889b5e4fa9281ae978a571ea771795af8e05c646db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ffe19c5e7909f3b

Targets

- Target
  1e923e1a2c8ce0b65c27c7eb4486cce24f376300d98e5aa2ef5f60ce306a39dc
- Size 1.8MB
- SHA256 1e923e1a2c8ce0b65c27c7eb4486cce24f376300d98e5aa2ef5f60ce306a39dc
- MD5 3a73440f795448b96205196d56f69269
- SHA1 035a826c7dddb53754523cc15ece9a0cad9e4e44
- SHA512 a5cf48449eaff2b4113056512491ad2966a26193f3be83452fa539a8d8988312b2aaaa2c6d290dc5181ec76a06c611bc0f56db5084f9ada3f26c131e6db2f591
- SSDEEP 49152:32OHOfqBhJP1w0oQ8dD9WxMs5KDAv4y1PNt7szni:mmp1ApdDwWkKDAAIPNt7szi
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2