socks5systemz

General

Target
blumfarm_W9CQClad9a.zip_pw_infected.zip
Size 6.2MB
Sample240604-js6wmsaf38
SHA256 eb91f920813289d597bce9216b2a2af7d327b53b0e21d3a2b5705be1149384ac
MD5 5664902531461aed15a6e0b558bb86cf
SHA1 571b28d0370b0c008c43182a2c278abc2a2febf4
SHA512 dea0eb034ab1ec90534ac2d1d4713999200e196fe24c7d8e565bce628157220561330d3c67b0f40769e34676de0004fb1d9c687200cac5934cd8ba61c4028c8d
SSDEEP 196608:ZUbwislc+bnWzBG/5uFmK98Nt+iR/yIPn4k2areVVR:ZUUisl1bEBi73f/yI+7/R
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  blumfarm_W9CQClad9a.exe
- Size 6.3MB
- SHA256 d8946020d5d75b42ea3ee28fcb29ab44ca2e47b51d9256f92914bcb4ebc0de23
- MD5 2f96d2c284fc2e7998663eec9a1cc401
- SHA1 f21730784d3086e24cc2e657a7d88dfc4c5d6d45
- SHA512 665ca27fa8a5779240b0ec5f965e5bed03ce1b4e6911ae590b0f78b5d7b58b745a5d72530b54cc7fe1f9ff022f0218a5d22ff1469fcb57ad4fd39add5535f427
- SSDEEP 98304:JAaDFuqJFhPlTCDTeIHM2y4nmN5YU+YC8aFZIA26yo9eIfVv+aNfr4AI/hsfU:WDqJvPcit2y4nmoIA7yoYeFr4AIefU
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

socks5systemz botnet discovery evasion execution persistence spyware stealer trojan
- Detect Socks5Systemz Payload
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Windows security bypass
  evasion trojan
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops Chrome extension
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2