socks5systemz

General

Target

71f4601b51274cfd5dfee83da432a679e48f51dd762b4d8bfc6a19a502c6a2f3
Size

4.8MB
Sample

240613-3c151ayemm
MD5

e6ec1657e7b8a6fac096ab94290e6055
SHA1

0b5946e927adf740015af03b40e317f6a60b0aba
SHA256

71f4601b51274cfd5dfee83da432a679e48f51dd762b4d8bfc6a19a502c6a2f3
SHA512

4b941366c3f9e7856a2db5c9ffdbc893318c3643cdfdeff776c58f6cac5cbf6833abdf8c33272f40d9c69333fb93d68ef082de3a3cd86adc431039dfde408d1b
SSDEEP

98304:mBE0LJzxolL/JUC28s7YfCnKvEDAbhhgOCp1jTVBcD7kM2NzR433R8DiNm3i:fwFxoRxxsAbCnOCnHzNt4R8DiNm3i

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

csynuiv.net

http://csynuiv.net/search/?q=67e28dd86f5ff42d4509ac187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8dfd10c0ea91

bedbdcb.com

http://bedbdcb.com/search/?q=67e28dd8685af379125bfd4e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ff712c2ee959e38

Targets

- Target
  
  71f4601b51274cfd5dfee83da432a679e48f51dd762b4d8bfc6a19a502c6a2f3
- Size
  
  4.8MB
- MD5
  
  e6ec1657e7b8a6fac096ab94290e6055
- SHA1
  
  0b5946e927adf740015af03b40e317f6a60b0aba
- SHA256
  
  71f4601b51274cfd5dfee83da432a679e48f51dd762b4d8bfc6a19a502c6a2f3
- SHA512
  
  4b941366c3f9e7856a2db5c9ffdbc893318c3643cdfdeff776c58f6cac5cbf6833abdf8c33272f40d9c69333fb93d68ef082de3a3cd86adc431039dfde408d1b
- SSDEEP
  
  98304:mBE0LJzxolL/JUC28s7YfCnKvEDAbhhgOCp1jTVBcD7kM2NzR433R8DiNm3i:fwFxoRxxsAbCnOCnHzNt4R8DiNm3i
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2