socks5systemz

General

Target

d7828adc3890d3700c8c9c26c86b86251734bb3d67a34131ea2167ac67f60042
Size

5.2MB
Sample

240614-w8wf3ascjg
MD5

5d5be483cacfa90d0e01eee3a79e0793
SHA1

a1e7b96ac6746d3a0be713a724f0323bf579f3bc
SHA256

d7828adc3890d3700c8c9c26c86b86251734bb3d67a34131ea2167ac67f60042
SHA512

e90694230854a8af72fa797d577a28c1b17ac11d33cdf89bd679f7e09b46a808c5ccbcd2f95aae51ef72abaf43a14b127ba4f93387daab9f8ad5446f4ceb4960
SSDEEP

98304:mvXyDHJpzLnMbEauFeQBHet+XdQUemHbvhCsVvDtwQTP2L5lyvk5PiRr8rN1VPXW:+YppzAI/wGHHFHdVBwQm5ly0qRrENDNU

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

bxpjvqn.com

http://bxpjvqn.com/search/?q=67e28dd83954f07a4008f8497c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff712c9ef979832

http://bxpjvqn.com/search/?q=67e28dd83954f07a4008f8497c27d78406abdd88be4b12eab517aa5c96bd86e895834c845a8bbc896c58e713bc90c91f36b5281fc235a925ed3e5cd6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee9d9932cd6d941f

ddvecyu.info

Targets

- Target
  
  d7828adc3890d3700c8c9c26c86b86251734bb3d67a34131ea2167ac67f60042
- Size
  
  5.2MB
- MD5
  
  5d5be483cacfa90d0e01eee3a79e0793
- SHA1
  
  a1e7b96ac6746d3a0be713a724f0323bf579f3bc
- SHA256
  
  d7828adc3890d3700c8c9c26c86b86251734bb3d67a34131ea2167ac67f60042
- SHA512
  
  e90694230854a8af72fa797d577a28c1b17ac11d33cdf89bd679f7e09b46a808c5ccbcd2f95aae51ef72abaf43a14b127ba4f93387daab9f8ad5446f4ceb4960
- SSDEEP
  
  98304:mvXyDHJpzLnMbEauFeQBHet+XdQUemHbvhCsVvDtwQTP2L5lyvk5PiRr8rN1VPXW:+YppzAI/wGHHFHdVBwQm5ly0qRrENDNU
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2