socks5systemz

General

Target

553ace89df50b8da15b46a191a96a9da81466169757ee8cfb704ce7d3ae4be9a
Size

3.8MB
Sample

240425-2aadtsfh79
MD5

00d2419eb68c1e94e21719c7c35eb44a
SHA1

a1125972d2784b8ec56831e2fe73ef74793a90fe
SHA256

553ace89df50b8da15b46a191a96a9da81466169757ee8cfb704ce7d3ae4be9a
SHA512

3cb035f44cbaf180f6935d103074dc2c8ebadd7fbb6d3ccb66632d09663305e19c6df492a7b1bce20b8a7ce46466c12889694e9f682686a06f0fcae15457c37e
SSDEEP

98304:+prPt3JYBlpW2NuI++UUsuUTkhocLNUL8/UPSgrpBd1Z4:yrTYvpW+uLzkhPaL/PSENX4

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

http://ebbbccq.ua/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a638ef712c8ef97

http://boptrwn.com/search/?q=67e28dd86d5ff028450dff177c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f571ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ffb11c8ec929332

http://boptrwn.com/search/?q=67e28dd86d5ff028450dff177c27d78406abdd88be4b12eab517aa5c96bd86ec948549895a8bbc896c58e713bc90c91936b5281fc235a925ed3e56d6bd974a95129070b616e96cc92be510b866db52bee348ee4c2b14a82966836f23d7f210c7ee919a33ce689f1f

Targets

- Target
  
  553ace89df50b8da15b46a191a96a9da81466169757ee8cfb704ce7d3ae4be9a
- Size
  
  3.8MB
- MD5
  
  00d2419eb68c1e94e21719c7c35eb44a
- SHA1
  
  a1125972d2784b8ec56831e2fe73ef74793a90fe
- SHA256
  
  553ace89df50b8da15b46a191a96a9da81466169757ee8cfb704ce7d3ae4be9a
- SHA512
  
  3cb035f44cbaf180f6935d103074dc2c8ebadd7fbb6d3ccb66632d09663305e19c6df492a7b1bce20b8a7ce46466c12889694e9f682686a06f0fcae15457c37e
- SSDEEP
  
  98304:+prPt3JYBlpW2NuI++UUsuUTkhocLNUL8/UPSgrpBd1Z4:yrTYvpW+uLzkhPaL/PSENX4
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2