General

  • Target

    6e2565704fb1fb4f805567f8977db234b65f4254ec5c17dabbb81d7e7e6b7d44

  • Size

    4.5MB

  • Sample

    240624-f5fcnsybng

  • MD5

    087c1a705e54a08fcb9a66d4465836bf

  • SHA1

    4bf4f2ee26a080450876235eaf3c331e457f88b3

  • SHA256

    6e2565704fb1fb4f805567f8977db234b65f4254ec5c17dabbb81d7e7e6b7d44

  • SHA512

    23d377391f7b97ce96ade93f3f9cfc8e4b45fe8b8b7f0a9e84d243f94e51e35b777022f3ab220a6aab230383c46aa3c9f993bf5c65cc304280a38c11341252de

  • SSDEEP

    98304:mM5rz5yT+bIwTH8FONkvusXgdZRL9RAdprFZeI/zVop/Frc7:jlIwTH8+kGs8RLPeZRLVotFrc7

Malware Config

Extracted

Family

socks5systemz

C2

csbstdj.net

http://csbstdj.net/search/?q=67e28dd86554fa2a495aa4197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a071ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6e8cff17c8e696

bwrcooe.com

http://bwrcooe.com/search/?q=67e28dd86d5ff028450dff177c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f571ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ff613c0e99d933b

Targets

    • Target

      6e2565704fb1fb4f805567f8977db234b65f4254ec5c17dabbb81d7e7e6b7d44

    • Size

      4.5MB

    • MD5

      087c1a705e54a08fcb9a66d4465836bf

    • SHA1

      4bf4f2ee26a080450876235eaf3c331e457f88b3

    • SHA256

      6e2565704fb1fb4f805567f8977db234b65f4254ec5c17dabbb81d7e7e6b7d44

    • SHA512

      23d377391f7b97ce96ade93f3f9cfc8e4b45fe8b8b7f0a9e84d243f94e51e35b777022f3ab220a6aab230383c46aa3c9f993bf5c65cc304280a38c11341252de

    • SSDEEP

      98304:mM5rz5yT+bIwTH8FONkvusXgdZRL9RAdprFZeI/zVop/Frc7:jlIwTH8+kGs8RLPeZRLVotFrc7

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks