socks5systemz

General

Target

57a644517840d27056fb208e3e9a88c54d0d6e9b84db65b520cc302af25d2e1f
Size

4.3MB
Sample

240422-fv17dsgc5w
MD5

be3082f150f762372fa1d9007ab53982
SHA1

b6dc42ce379479b2ce51ebef86a0cbc1be3cee5a
SHA256

57a644517840d27056fb208e3e9a88c54d0d6e9b84db65b520cc302af25d2e1f
SHA512

8cd7434892719b71a72380c77b4d4e547a8550a412e3cd5fc858031ce9c0f196a8f006fe039d5ada2cf658ef6bd76477fdfc1aa40650f1e47a77a7df6cf5345f
SSDEEP

98304:7aGgvD5y2Vk1sZxV4DYhaCIvuXkPJdq9t2mk0bKzm8:VT2W/Yhxhkhda2mo

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

http://cseogbp.net/search/?q=67e28dd83955a42b4006aa1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ee8889b5e4fa9281ae978f671ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6489f913c8ee97

http://bheosdz.com/search/?q=67e28dd8685af379125bfd4e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ffc16c6ed9d9b38

Targets

- Target
  
  57a644517840d27056fb208e3e9a88c54d0d6e9b84db65b520cc302af25d2e1f
- Size
  
  4.3MB
- MD5
  
  be3082f150f762372fa1d9007ab53982
- SHA1
  
  b6dc42ce379479b2ce51ebef86a0cbc1be3cee5a
- SHA256
  
  57a644517840d27056fb208e3e9a88c54d0d6e9b84db65b520cc302af25d2e1f
- SHA512
  
  8cd7434892719b71a72380c77b4d4e547a8550a412e3cd5fc858031ce9c0f196a8f006fe039d5ada2cf658ef6bd76477fdfc1aa40650f1e47a77a7df6cf5345f
- SSDEEP
  
  98304:7aGgvD5y2Vk1sZxV4DYhaCIvuXkPJdq9t2mk0bKzm8:VT2W/Yhxhkhda2mo
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2