socks5systemz

General

Target

0f5477b1eef752e1c26ae01c34cf9cc976cd60d2fa9e436131978cf4443c71d0
Size

4.4MB
Sample

240425-a8hdjsce4t
MD5

e5d4bec23f8e598ee2dbcfd0d7c89669
SHA1

a5414667409e779a675e298d6af75d624aed6e45
SHA256

0f5477b1eef752e1c26ae01c34cf9cc976cd60d2fa9e436131978cf4443c71d0
SHA512

5a62b62159d43b413fac953899f021ebbe507b1b85bd843681e04cf3e6e01deb678109b7c79c0d82b745e1b47084ab12034860f734e98a8b2ee754761645abb2
SSDEEP

98304:7a6CKyoS7k9rnRvt2byl0uHrC7fOBPZtNZftodZKe1hj62It210K:xyvkVnRvtjl0mr6fm7ZSTKeuQ

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

http://bneailk.com/search/?q=67e28dd83955a42b4006aa1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ee8889b5e4fa9281ae978f671ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a638eff17c4ec9c

http://bfpkcwe.com/search/?q=67e28dd86809f27b415ba51b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a771ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ffb11c0e991993c

Targets

- Target
  
  0f5477b1eef752e1c26ae01c34cf9cc976cd60d2fa9e436131978cf4443c71d0
- Size
  
  4.4MB
- MD5
  
  e5d4bec23f8e598ee2dbcfd0d7c89669
- SHA1
  
  a5414667409e779a675e298d6af75d624aed6e45
- SHA256
  
  0f5477b1eef752e1c26ae01c34cf9cc976cd60d2fa9e436131978cf4443c71d0
- SHA512
  
  5a62b62159d43b413fac953899f021ebbe507b1b85bd843681e04cf3e6e01deb678109b7c79c0d82b745e1b47084ab12034860f734e98a8b2ee754761645abb2
- SSDEEP
  
  98304:7a6CKyoS7k9rnRvt2byl0uHrC7fOBPZtNZftodZKe1hj62It210K:xyvkVnRvtjl0mr6fm7ZSTKeuQ
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2