socks5systemz

General

Target

f59c0b138e82c010bb78e51ec65935e85ff9f1116835e9741f3b0706dae5fd73
Size

4.8MB
Sample

240620-nfrcmsyemr
MD5

a2dafa97c3f08e05a15bc6c278ba6555
SHA1

159793c91b3af3f373b76966c6fd3d711a2d3518
SHA256

f59c0b138e82c010bb78e51ec65935e85ff9f1116835e9741f3b0706dae5fd73
SHA512

c674db8b0ad93344368e136e9365480ffdabbb8fc1a254c533f71d9e30056c5a3f285102d61a20747d58e2db4c4da9b06fc9ca54aed2f80597e50cc947739737
SSDEEP

98304:m2dH989GXksBfY+HQzhB6g5LFsxr2ovBN9zGgeqNVLmijthRey:xZ9rXkCshB6g55sl2o5N9zxLnjthR1

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

csinjpd.net

http://csinjpd.net/search/?q=67e28dd83f08f52f150eab187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978f471ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff719c8ed909a3d

http://csinjpd.net/search/?q=67e28dd83f08f52f150eab187c27d78406abdd88be4b12eab517aa5c96bd86e892874e845a8bbc896c58e713bc90c91f36b5281fc235a925ed3e57d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee9d9233cf6a9610

bhminhf.com

Targets

- Target
  
  f59c0b138e82c010bb78e51ec65935e85ff9f1116835e9741f3b0706dae5fd73
- Size
  
  4.8MB
- MD5
  
  a2dafa97c3f08e05a15bc6c278ba6555
- SHA1
  
  159793c91b3af3f373b76966c6fd3d711a2d3518
- SHA256
  
  f59c0b138e82c010bb78e51ec65935e85ff9f1116835e9741f3b0706dae5fd73
- SHA512
  
  c674db8b0ad93344368e136e9365480ffdabbb8fc1a254c533f71d9e30056c5a3f285102d61a20747d58e2db4c4da9b06fc9ca54aed2f80597e50cc947739737
- SSDEEP
  
  98304:m2dH989GXksBfY+HQzhB6g5LFsxr2ovBN9zGgeqNVLmijthRey:xZ9rXkCshB6g55sl2o5N9zxLnjthR1
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2