socks5systemz | d07146e96d84f8d0f341b2a9b4661caa04ef232afe63a6c4627acac02399f01c | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

winprofile

windows7-x64

winprofile

windows10-1703-x64

Sharing

General

Target

d07146e96d84f8d0f341b2a9b4661caa04ef232afe63a6c4627acac02399f01c
Size

5.5MB
Sample

240708-frf22swbld
MD5

141a5970c9b3f1af2f116cc049c7407d
SHA1

ce680835935661a6b3c71477fbdbba4650b1ae8e
SHA256

d07146e96d84f8d0f341b2a9b4661caa04ef232afe63a6c4627acac02399f01c
SHA512

7d699588cd9f07124fab31359529d381a7962e81314b0fa9f7f49ee4d384f96aa5efb6861037b0569a1ccdea835d1bfd8da0dfc3f552504fbf6268b092368067
SSDEEP

98304:CHk1OWGS5CgSRrRICt74ea6VaLQyOUbcZjw3UgMruMbN9HgpSUIhXFuv0Qx/:GKOWdEgS1L8ea6VaLFOUoZjwCnbbApSu

Score

10^/10

socks5systemz botnet discovery

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

d07146e96d84f8d0f341b2a9b4661caa04ef232afe63a6c4627acac02399f01c.exe

Resource

win7-20240705-en

socks5systemz botnet discovery

windows7-x64

9 signatures

300 seconds

Behavioral task

behavioral2

Sample

d07146e96d84f8d0f341b2a9b4661caa04ef232afe63a6c4627acac02399f01c.exe

Resource

win10-20240404-en

socks5systemz botnet discovery

windows10-1703-x64

9 signatures

300 seconds

Malware Config

Targets

- Target
  
  d07146e96d84f8d0f341b2a9b4661caa04ef232afe63a6c4627acac02399f01c
- Size
  
  5.5MB
- MD5
  
  141a5970c9b3f1af2f116cc049c7407d
- SHA1
  
  ce680835935661a6b3c71477fbdbba4650b1ae8e
- SHA256
  
  d07146e96d84f8d0f341b2a9b4661caa04ef232afe63a6c4627acac02399f01c
- SHA512
  
  7d699588cd9f07124fab31359529d381a7962e81314b0fa9f7f49ee4d384f96aa5efb6861037b0569a1ccdea835d1bfd8da0dfc3f552504fbf6268b092368067
- SSDEEP
  
  98304:CHk1OWGS5CgSRrRICt74ea6VaLQyOUbcZjw3UgMruMbN9HgpSUIhXFuv0Qx/:GKOWdEgS1L8ea6VaLFOUoZjwCnbbApSu
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

socks5systemzbotnetdiscovery

behavioral2

socks5systemzbotnetdiscovery

© 2018-2025

Terms | Privacy