socks5systemz

General

Target

f8a2ccca7169f8614f391ef10b6d2aa983645dfe7c57e2465f8c69e5b73c9897
Size

5.0MB
Sample

240620-ph8v5sxaqb
MD5

49db2b47753414ac9baf0f7e8a6b7bda
SHA1

b651a8de04f7d939f7d50322e8adeea591af484b
SHA256

f8a2ccca7169f8614f391ef10b6d2aa983645dfe7c57e2465f8c69e5b73c9897
SHA512

e8d3b0c4d9b3e5c65b0710318c774f5c6155db92dfbd9aa8b7d9be9840da7c2972f120ce05ba39b7e4a8f4ceaa7de164d6b4a42965361acda50dcc9c73951aa5
SSDEEP

98304:mPGc9feSX5Hg7oteI8QeQD1cJrXlqV5Fu4u9MXJbQ6gOKdXA9ya7GOIb:879LqQrc1XAk4u9MZbYO4XjOIb

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

bvbxbis.com

http://bvbxbis.com/search/?q=67e28dd83f08f52f150eab187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978f471ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff719c8e994983a

http://bvbxbis.com/search/?q=67e28dd83f08f52f150eab187c27d78406abdd88be4b12eab517aa5c96bd86e892874e845a8bbc896c58e713bc90c91f36b5281fc235a925ed3e57d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee9d9233cb6e9417

cewpiec.net

Targets

- Target
  
  f8a2ccca7169f8614f391ef10b6d2aa983645dfe7c57e2465f8c69e5b73c9897
- Size
  
  5.0MB
- MD5
  
  49db2b47753414ac9baf0f7e8a6b7bda
- SHA1
  
  b651a8de04f7d939f7d50322e8adeea591af484b
- SHA256
  
  f8a2ccca7169f8614f391ef10b6d2aa983645dfe7c57e2465f8c69e5b73c9897
- SHA512
  
  e8d3b0c4d9b3e5c65b0710318c774f5c6155db92dfbd9aa8b7d9be9840da7c2972f120ce05ba39b7e4a8f4ceaa7de164d6b4a42965361acda50dcc9c73951aa5
- SSDEEP
  
  98304:mPGc9feSX5Hg7oteI8QeQD1cJrXlqV5Fu4u9MXJbQ6gOKdXA9ya7GOIb:879LqQrc1XAk4u9MZbYO4XjOIb
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2