socks5systemz

General

Target

bc5a6031a5cb970082919f4f964c4c61f507216228e69a4c47b34df4a935ca8b
Size

4.9MB
Sample

240620-yc8gvsycpj
MD5

a19099d0dc343d56139d20e2e6352735
SHA1

160f72d0054ac8d61592538045b568ca3207c084
SHA256

bc5a6031a5cb970082919f4f964c4c61f507216228e69a4c47b34df4a935ca8b
SHA512

3a8e421b23eed5d3c158be2f0c4677f13a8b03aeae42cdb56a3eaadf72bd8e0e5e8d30ccb2ac6857721906bc038331bc052c9878d6ad3ccca22996d0e130a877
SSDEEP

98304:mgPKtRqaZqaQ82Q8w0BOM4ocwKc330mSqzm4pALQLUXHTkozADll:smaZqaQhw0BO5NPcbmkgKUVADll

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

bpexeio.com

bouoiir.com

http://bouoiir.com/search/?q=67e28dd8655df07d165afd1f7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a271ea771795af8e05c645db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ff718c1ed919933

http://bouoiir.com/search/?q=67e28dd8655df07d165afd1f7c27d78406abdd88be4b12eab517aa5c96bd86ef92824c855a8bbc896c58e713bc90c91936b5281fc235a925ed3e01d6bd974a95129070b616e96cc92be510b866db51b9e34eed4c2b14a82966836f23d7f210c7ee9d933acf6b951e

Targets

- Target
  
  bc5a6031a5cb970082919f4f964c4c61f507216228e69a4c47b34df4a935ca8b
- Size
  
  4.9MB
- MD5
  
  a19099d0dc343d56139d20e2e6352735
- SHA1
  
  160f72d0054ac8d61592538045b568ca3207c084
- SHA256
  
  bc5a6031a5cb970082919f4f964c4c61f507216228e69a4c47b34df4a935ca8b
- SHA512
  
  3a8e421b23eed5d3c158be2f0c4677f13a8b03aeae42cdb56a3eaadf72bd8e0e5e8d30ccb2ac6857721906bc038331bc052c9878d6ad3ccca22996d0e130a877
- SSDEEP
  
  98304:mgPKtRqaZqaQ82Q8w0BOM4ocwKc330mSqzm4pALQLUXHTkozADll:smaZqaQhw0BO5NPcbmkgKUVADll
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2