socks5systemz

General

Target

f92a7231efb1a1b09a75a192c77ce4ef987aaf8e30461c6ebe87e4f1e5ab1cfb.exe
Size

4.8MB
Sample

240614-cls8ms1gkh
MD5

3a3f2b6cf16df6e530ae030c3be307c2
SHA1

0fe3ab13d06626b1eceb30e1ed12eee04b5a5c0f
SHA256

f92a7231efb1a1b09a75a192c77ce4ef987aaf8e30461c6ebe87e4f1e5ab1cfb
SHA512

aa3937e3c1ca6da3de8a21be3f5cecc0c366bbf952fb0395b9e489bdff3a3f83f9a4f9c339300b571e94a176f87db51620245a1006fe63715ec7735f1687fcb8
SSDEEP

98304:mpwE8fyZeFg0wBonhkqSZ7Zz31HinzB4CMkQjSeJBmTE:i1ZZeFg0vaZ7l31inaCt6mo

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

aqtlcgn.ru

ckpdveq.net

http://ckpdveq.net/search/?q=67e28dd8685ff37d4306f81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ee8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff712c3ee959238

Targets

- Target
  
  f92a7231efb1a1b09a75a192c77ce4ef987aaf8e30461c6ebe87e4f1e5ab1cfb.exe
- Size
  
  4.8MB
- MD5
  
  3a3f2b6cf16df6e530ae030c3be307c2
- SHA1
  
  0fe3ab13d06626b1eceb30e1ed12eee04b5a5c0f
- SHA256
  
  f92a7231efb1a1b09a75a192c77ce4ef987aaf8e30461c6ebe87e4f1e5ab1cfb
- SHA512
  
  aa3937e3c1ca6da3de8a21be3f5cecc0c366bbf952fb0395b9e489bdff3a3f83f9a4f9c339300b571e94a176f87db51620245a1006fe63715ec7735f1687fcb8
- SSDEEP
  
  98304:mpwE8fyZeFg0wBonhkqSZ7Zz31HinzB4CMkQjSeJBmTE:i1ZZeFg0vaZ7l31inaCt6mo
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Detects executables packed with VMProtect.
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Detects executables packed with VMProtect.

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2