socks5systemz

General

Target

711a3d40a6ad00ea3bb74dee4e73c154e77b6c213c778bb7d66fd717ee9fe227
Size

3.2MB
Sample

240425-da4exaea34
MD5

08716c77eb12b403c525571c36c29fee
SHA1

79fd1277383dd98dc10ba3c4b98d8209990e5296
SHA256

711a3d40a6ad00ea3bb74dee4e73c154e77b6c213c778bb7d66fd717ee9fe227
SHA512

0c4cf1f567cee5bdc9acde76d2a21c871305f3eeb744673e172658b0779ad4152ef62326911d52bf1f9232047b4e08ca7b3c400b9d2bf64ca4ad2e871716c4b2
SSDEEP

98304:7aHTOvn78dZWXVxqbbHmPbLfsLWViGGerhiVy:cOv78POsLUiGGeL

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

http://aintahb.ru/search/?q=67e28dd83955a42b4006aa1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ee8889b5e4fa9281ae978f671ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a638efe12c4ed97

http://buzloln.com/search/?q=67e28dd86d5ff028450dff177c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f571ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ffb11c1ec919839

Targets

- Target
  
  711a3d40a6ad00ea3bb74dee4e73c154e77b6c213c778bb7d66fd717ee9fe227
- Size
  
  3.2MB
- MD5
  
  08716c77eb12b403c525571c36c29fee
- SHA1
  
  79fd1277383dd98dc10ba3c4b98d8209990e5296
- SHA256
  
  711a3d40a6ad00ea3bb74dee4e73c154e77b6c213c778bb7d66fd717ee9fe227
- SHA512
  
  0c4cf1f567cee5bdc9acde76d2a21c871305f3eeb744673e172658b0779ad4152ef62326911d52bf1f9232047b4e08ca7b3c400b9d2bf64ca4ad2e871716c4b2
- SSDEEP
  
  98304:7aHTOvn78dZWXVxqbbHmPbLfsLWViGGerhiVy:cOv78POsLUiGGeL
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2