General

  • Target

    c4e786064636ee2d18853922e009f8eeb953057f3e78fde676f96e03a0df7521

  • Size

    4.6MB

  • Sample

    240624-ggdplssblr

  • MD5

    5f0f4931aa863ecffc5a8d3528651803

  • SHA1

    0c6348ae759dbde0810315d88045c14b20ec437d

  • SHA256

    c4e786064636ee2d18853922e009f8eeb953057f3e78fde676f96e03a0df7521

  • SHA512

    041a284b4aa9d67a8871353bb135513e14e3752b616af3bde59051f65526a3c77f030bca2ca1d44d1a8904996cb4c2462d5a6a08009cf0f798b31b659c3ed19e

  • SSDEEP

    98304:mBC1ikeSt91ispFtFph4XT9SeAMwYenrYOQj6rP6cL6nJyg:okeSND/ph4XBSeAC4SjSP6E6nJn

Malware Config

Extracted

Family

socks5systemz

C2

aizksya.ru

http://aizksya.ru/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6e8cff19c0eb95

aatlqoe.ru

http://aatlqoe.ru/search/?q=67e28dd86809f27b415ba51b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a771ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ff613c0e7959933

Targets

    • Target

      c4e786064636ee2d18853922e009f8eeb953057f3e78fde676f96e03a0df7521

    • Size

      4.6MB

    • MD5

      5f0f4931aa863ecffc5a8d3528651803

    • SHA1

      0c6348ae759dbde0810315d88045c14b20ec437d

    • SHA256

      c4e786064636ee2d18853922e009f8eeb953057f3e78fde676f96e03a0df7521

    • SHA512

      041a284b4aa9d67a8871353bb135513e14e3752b616af3bde59051f65526a3c77f030bca2ca1d44d1a8904996cb4c2462d5a6a08009cf0f798b31b659c3ed19e

    • SSDEEP

      98304:mBC1ikeSt91ispFtFph4XT9SeAMwYenrYOQj6rP6cL6nJyg:okeSND/ph4XBSeAC4SjSP6E6nJn

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks