socks5systemz

General

Target

51bb1e820aa2e4148973c854ddb8a322cccca0f4885fb40cb62e760feaf8e9d9
Size

4.8MB
Sample

240620-2pstqavfjm
MD5

386c7d06155d8754f0eeddf9a984eef2
SHA1

1613630666cb0ba426ad0acf0cb8a6d7ee0d2a4e
SHA256

51bb1e820aa2e4148973c854ddb8a322cccca0f4885fb40cb62e760feaf8e9d9
SHA512

5e2e1b8229e5e6026277b1630cc718592667aeef3603979ca0a08f137856f3ebed5765dd699107db0646ced40d8e2ffa539877272ab62b4ac52e179ef0f39f82
SSDEEP

98304:my5CT2EQsbOgvAi9VaFgWoTKOwTuKRygJlt4A5nG/C:1CT2Hgvbbm4JwSKRy+BVG/C

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

bbuwnip.com

http://bbuwnip.com/search/?q=67e28dd86c0ca72e110aab177c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978f671ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f87fd12c6ee93

bhvfdte.com

http://bhvfdte.com/search/?q=67e28dd8690ba728400aae4c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ff718c2ec93983d

Targets

- Target
  
  51bb1e820aa2e4148973c854ddb8a322cccca0f4885fb40cb62e760feaf8e9d9
- Size
  
  4.8MB
- MD5
  
  386c7d06155d8754f0eeddf9a984eef2
- SHA1
  
  1613630666cb0ba426ad0acf0cb8a6d7ee0d2a4e
- SHA256
  
  51bb1e820aa2e4148973c854ddb8a322cccca0f4885fb40cb62e760feaf8e9d9
- SHA512
  
  5e2e1b8229e5e6026277b1630cc718592667aeef3603979ca0a08f137856f3ebed5765dd699107db0646ced40d8e2ffa539877272ab62b4ac52e179ef0f39f82
- SSDEEP
  
  98304:my5CT2EQsbOgvAi9VaFgWoTKOwTuKRygJlt4A5nG/C:1CT2Hgvbbm4JwSKRy+BVG/C
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2