socks5systemz

General

Target

b86f509978dec1f400e89a63d2de8b770363b2e904316e9063b9ad46c080175f.exe
Size

4.8MB
Sample

240614-ccfwysvcpq
MD5

380d33122267e606830bba85597bbb9c
SHA1

3c280b31f6be9b2a0d15f1cf0d932f314bbb724f
SHA256

b86f509978dec1f400e89a63d2de8b770363b2e904316e9063b9ad46c080175f
SHA512

b7fa933a545da21541a38d5a14c376710cf792e222ebe4ab751d5090eb42f0ca4bf6dc90f943a67525c02d2684fdc9c8a973df46ca78204fe0d7ce47719053c1
SSDEEP

98304:m1vNssAFCK0nMd3lhQ0UOaHc27PivQ5HOwRTtLrh4D9q1SKJetbNolkcZU:jsm93lhgOekM/Bt3o99tbO/ZU

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

ebngmpo.ua

http://ebngmpo.ua/search/?q=67e28dd86554fa2a495aa4197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a071ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8dfc11c2ef92

http://ebngmpo.ua/search/?q=67e28dd86554fa2a495aa4197c27d78406abdd88be4b12eab517aa5c96bd86e596824996148ab2865b77f80ebad9c50f7cb63037ed2ab423a4654383ba915d911ec07bb606a0708720fa11b861c353baf51aba1e7242fa7023cc366689fe19c3ec95983bca

aifqvdn.ru

Targets

- Target
  
  b86f509978dec1f400e89a63d2de8b770363b2e904316e9063b9ad46c080175f.exe
- Size
  
  4.8MB
- MD5
  
  380d33122267e606830bba85597bbb9c
- SHA1
  
  3c280b31f6be9b2a0d15f1cf0d932f314bbb724f
- SHA256
  
  b86f509978dec1f400e89a63d2de8b770363b2e904316e9063b9ad46c080175f
- SHA512
  
  b7fa933a545da21541a38d5a14c376710cf792e222ebe4ab751d5090eb42f0ca4bf6dc90f943a67525c02d2684fdc9c8a973df46ca78204fe0d7ce47719053c1
- SSDEEP
  
  98304:m1vNssAFCK0nMd3lhQ0UOaHc27PivQ5HOwRTtLrh4D9q1SKJetbNolkcZU:jsm93lhgOekM/Bt3o99tbO/ZU
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Detects executables packed with VMProtect.
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Detects executables packed with VMProtect.

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2