Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8a0cfec4f639d89430d14e308badb887a2d0a3eeb6ca1ec47fe508036daf72c3

  • Size

    4.5MB

  • Sample

    240618-wy3sdsyaqj

  • MD5

    cc5422c5eabf3681cfe06f942d9c067c

  • SHA1

    e572f86476e966de4cea21f3fc36b86f3a3c3c3b

  • SHA256

    8a0cfec4f639d89430d14e308badb887a2d0a3eeb6ca1ec47fe508036daf72c3

  • SHA512

    bc8298e8071331242ded71bcc4375dd517633707b7bef1b46bea0801517ee78c25ab8c3ae3e9399aeb1341ba23ccf39b085d88bc48402f1da1a77e83cf9b8344

  • SSDEEP

    98304:m0NldDqF8x3o7Jm41QlroyQHJ+w6c5D4CutCHCUEC:/qK3QuvQHJ+wzDM/pC

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Extracted

Family

socks5systemz

C2

bhozhna.com

http://bhozhna.com/search/?q=67e28dd86d5ff17c1407ad1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ee8889b5e4fa9281ae978f571ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff716c3eb9c9a3e

boptteb.com

Targets

    • Target

      8a0cfec4f639d89430d14e308badb887a2d0a3eeb6ca1ec47fe508036daf72c3

    • Size

      4.5MB

    • MD5

      cc5422c5eabf3681cfe06f942d9c067c

    • SHA1

      e572f86476e966de4cea21f3fc36b86f3a3c3c3b

    • SHA256

      8a0cfec4f639d89430d14e308badb887a2d0a3eeb6ca1ec47fe508036daf72c3

    • SHA512

      bc8298e8071331242ded71bcc4375dd517633707b7bef1b46bea0801517ee78c25ab8c3ae3e9399aeb1341ba23ccf39b085d88bc48402f1da1a77e83cf9b8344

    • SSDEEP

      98304:m0NldDqF8x3o7Jm41QlroyQHJ+w6c5D4CutCHCUEC:/qK3QuvQHJ+wzDM/pC

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks