socks5systemz

General

Target

aafc380e4646322f0a833feaf483908a58f6926df0d27f6ca7a15e416c745122
Size

4.8MB
Sample

240614-yz7tvathjh
MD5

5a533f10b239cefbf099274f03862921
SHA1

da592fed5e1d88339cf4979b3041780dc61fe99a
SHA256

aafc380e4646322f0a833feaf483908a58f6926df0d27f6ca7a15e416c745122
SHA512

60e8c3e7b2d3e402a7a8a55889671366b7a0e982c7b9cb25e3c11cf4b85d83a4e0ba2bb1596871889d824ff889db87cd62da0759b95b20374d9ba56e427ecba1
SSDEEP

98304:mZpMGuOjq1Hr7EidC1LR5ha450Z8ui47OWY4Rf8aISqSZ+WD4d/7SnJp/C:3GfqVI1Lrw45K247hY4RBhXbD4hGp/C

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

ebuogcv.ua

ckiiine.net

http://ckiiine.net/search/?q=67e28dd8655df07d165afd1f7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a271ea771795af8e05c645db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ff712c9e9949e3b

http://ckiiine.net/search/?q=67e28dd8655df07d165afd1f7c27d78406abdd88be4b12eab517aa5c96bd86ee95844a885a8bbc896c58e713bc90c91936b5281fc235a925ed3e01d6bd974a95129070b616e96cc92be510b866db51b9e34eed4c2b14a82966836f23d7f210c7ee9d9932cb6e9216

Targets

- Target
  
  aafc380e4646322f0a833feaf483908a58f6926df0d27f6ca7a15e416c745122
- Size
  
  4.8MB
- MD5
  
  5a533f10b239cefbf099274f03862921
- SHA1
  
  da592fed5e1d88339cf4979b3041780dc61fe99a
- SHA256
  
  aafc380e4646322f0a833feaf483908a58f6926df0d27f6ca7a15e416c745122
- SHA512
  
  60e8c3e7b2d3e402a7a8a55889671366b7a0e982c7b9cb25e3c11cf4b85d83a4e0ba2bb1596871889d824ff889db87cd62da0759b95b20374d9ba56e427ecba1
- SSDEEP
  
  98304:mZpMGuOjq1Hr7EidC1LR5ha450Z8ui47OWY4Rf8aISqSZ+WD4d/7SnJp/C:3GfqVI1Lrw45K247hY4RBhXbD4hGp/C
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2