socks5systemz

General

Target

87a542d2d37cd8ef40edc3dfb01c57cc29931949148a90d7e3745b69a7e6c74b
Size

4.9MB
Sample

240620-bycwra1enf
MD5

14f04e8d2ae1867a37d0afff0a524a0e
SHA1

4a133dfc34d64e92bfe4e743a786a57ebe1ad170
SHA256

87a542d2d37cd8ef40edc3dfb01c57cc29931949148a90d7e3745b69a7e6c74b
SHA512

439d135b7fa45610c199f33ffdab07791242fb25273511605a00197499c2c63f6ee036a2bb3ceb9c78b4798afe4ddb19ed30ff8f48da47bd75f465d055996154
SSDEEP

98304:m9k9X61fvwd4OZAMDbdX9M6CMbj9E2DSLbqt4SAPsmwgooDw4ubXsk:2oJd4yrHMaE2D0Gt4jVwgDLS8k

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

boxbupk.com

http://boxbupk.com/search/?q=67e28dd83a5da32a155afd1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a271ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff719c4e8979f33

eruhoxu.ua

http://eruhoxu.ua/search/?q=67e28dd83f5ff27c445aaa4e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ee8889b5e4fa9281ae978f171ea771795af8e05c645db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ff719c4e897993a

http://eruhoxu.ua/search/?q=67e28dd83f5ff27c445aaa4e7c27d78406abdd88be4b12eab517aa5c96bd86ec94874a855a8bbc896c58e713bc90c91b36b5281fc235a925ed3e52d6bd974a95129070b616e96cc92be510b866db51b9e34eed4c2b14a82966836f23d7f210c7ee9d923fca6d9517

Targets

- Target
  
  87a542d2d37cd8ef40edc3dfb01c57cc29931949148a90d7e3745b69a7e6c74b
- Size
  
  4.9MB
- MD5
  
  14f04e8d2ae1867a37d0afff0a524a0e
- SHA1
  
  4a133dfc34d64e92bfe4e743a786a57ebe1ad170
- SHA256
  
  87a542d2d37cd8ef40edc3dfb01c57cc29931949148a90d7e3745b69a7e6c74b
- SHA512
  
  439d135b7fa45610c199f33ffdab07791242fb25273511605a00197499c2c63f6ee036a2bb3ceb9c78b4798afe4ddb19ed30ff8f48da47bd75f465d055996154
- SSDEEP
  
  98304:m9k9X61fvwd4OZAMDbdX9M6CMbj9E2DSLbqt4SAPsmwgooDw4ubXsk:2oJd4yrHMaE2D0Gt4jVwgDLS8k
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2