socks5systemz

General

Target
noode.exe
Size 2.9MB
Sample240921-1eb8jsveng
SHA256 af900d9dda235bf8a4c20b724a3d79daf8b87cbe1acd4a93af348203a45cc33c
MD5 7b4edff2770fcb1177128a9985d02495
SHA1 9e406e801fa1c7e87d6c8cbdbf4c583ee80f36cf
SHA512 cf353cc34796fa8c1d766cc4d030a5b23ca27ffb2b17b6681ba7de21ba2dc62d5d4570c7a639e2e1c7271be42a48cb298f23479870cac101a6cf77f236308ba8
SSDEEP 49152:C9cBR7ZSQ1+5so+rhL4I7XX0gKeRin/LH11Q9ZpbiU/gENxnHjkFopgrDcmsPZOf:McBRKso+rzXX037n/LHrQ92ogEN5Hpsb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  noode.exe
- Size 2.9MB
- SHA256 af900d9dda235bf8a4c20b724a3d79daf8b87cbe1acd4a93af348203a45cc33c
- MD5 7b4edff2770fcb1177128a9985d02495
- SHA1 9e406e801fa1c7e87d6c8cbdbf4c583ee80f36cf
- SHA512 cf353cc34796fa8c1d766cc4d030a5b23ca27ffb2b17b6681ba7de21ba2dc62d5d4570c7a639e2e1c7271be42a48cb298f23479870cac101a6cf77f236308ba8
- SSDEEP 49152:C9cBR7ZSQ1+5so+rhL4I7XX0gKeRin/LH11Q9ZpbiU/gENxnHjkFopgrDcmsPZOf:McBRKso+rzXX037n/LHrQ92ogEN5Hpsb
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4