socks5systemz

General

Target

7fa1705c4562b01a8779dd823fd91977e381d007aa0df1b7fe2b14a4573c7335
Size

5.0MB
Sample

240613-fkdy4sydmn
MD5

2dc01538975ccf81719fde06d86258de
SHA1

7221f4adc75179ba3ba649803637cc8d0b249690
SHA256

7fa1705c4562b01a8779dd823fd91977e381d007aa0df1b7fe2b14a4573c7335
SHA512

9463403c379722094836ed1596e3efbcf0026688172ad2a2ae3aff9f4683055a934e8a93580a2c9380afd3fffe63909a5c827149d2bfbb726c92766623fc4eca
SSDEEP

98304:m54W02z7ekO/GxuMoaOLkiyPMExTIfSGB4gMyhrVdFyRQBWRtT3JTy:Y4V/Gxu5joipE9Ifljxr9ug

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

bpimkum.com

http://bpimkum.com/search/?q=67e28dd83954f07a4008f8497c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff713c5eb939a39

http://bpimkum.com/search/?q=67e28dd83954f07a4008f8497c27d78406abdd88be4b12eab517aa5c96bd86e895834c845a8bbc896c58e713bc90c91f36b5281fc235a925ed3e5cd6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee9d983ec9699614

bfpujey.com

Targets

- Target
  
  7fa1705c4562b01a8779dd823fd91977e381d007aa0df1b7fe2b14a4573c7335
- Size
  
  5.0MB
- MD5
  
  2dc01538975ccf81719fde06d86258de
- SHA1
  
  7221f4adc75179ba3ba649803637cc8d0b249690
- SHA256
  
  7fa1705c4562b01a8779dd823fd91977e381d007aa0df1b7fe2b14a4573c7335
- SHA512
  
  9463403c379722094836ed1596e3efbcf0026688172ad2a2ae3aff9f4683055a934e8a93580a2c9380afd3fffe63909a5c827149d2bfbb726c92766623fc4eca
- SSDEEP
  
  98304:m54W02z7ekO/GxuMoaOLkiyPMExTIfSGB4gMyhrVdFyRQBWRtT3JTy:Y4V/Gxu5joipE9Ifljxr9ug
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2