socks5systemz | b4bc6912b49e92eb1954f02f250832fa45b3af50bf037028119d83bb2df12bff | Triage

Submit
Reports

Overview

overview

Static

static

3

b4bc6912b4...ff.exe

windows7-x64

b4bc6912b4...ff.exe

windows10-2004-x64

Sharing

General

Target

b4bc6912b49e92eb1954f02f250832fa45b3af50bf037028119d83bb2df12bff
Size

5.3MB
Sample

241101-ktwbzazrhp
MD5

7135ac4442239680347f1119fb5febca
SHA1

f5af5757abba7e857f47215e312501d37a1b5b9a
SHA256

b4bc6912b49e92eb1954f02f250832fa45b3af50bf037028119d83bb2df12bff
SHA512

926092eb6bd43c7040f5b1b295538c2e475a01adb71fed9b7b776ecf417116ec11ae017c9d6857681ec0e9372063ee6201feaa96c45ae44f83a771f2f2bb21d1
SSDEEP

98304:MfnmS5xM/E7TjSQMEkr3c+UyZUZgK38stOhihXZZByW7eQFo118NO7nodboBx6Vw:Wmiy/qWhJ3dcO67FrNOEdbouQzsU

Score

10^/10

socks5systemz botnet discovery

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

b4bc6912b49e92eb1954f02f250832fa45b3af50bf037028119d83bb2df12bff.exe

Resource

win7-20241010-en

socks5systemz botnet discovery

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

b4bc6912b49e92eb1954f02f250832fa45b3af50bf037028119d83bb2df12bff.exe

Resource

win10v2004-20241007-en

socks5systemz botnet discovery

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  b4bc6912b49e92eb1954f02f250832fa45b3af50bf037028119d83bb2df12bff
- Size
  
  5.3MB
- MD5
  
  7135ac4442239680347f1119fb5febca
- SHA1
  
  f5af5757abba7e857f47215e312501d37a1b5b9a
- SHA256
  
  b4bc6912b49e92eb1954f02f250832fa45b3af50bf037028119d83bb2df12bff
- SHA512
  
  926092eb6bd43c7040f5b1b295538c2e475a01adb71fed9b7b776ecf417116ec11ae017c9d6857681ec0e9372063ee6201feaa96c45ae44f83a771f2f2bb21d1
- SSDEEP
  
  98304:MfnmS5xM/E7TjSQMEkr3c+UyZUZgK38stOhihXZZByW7eQFo118NO7nodboBx6Vw:Wmiy/qWhJ3dcO67FrNOEdbouQzsU
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Socks5systemz family
  socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

socks5systemzbotnetdiscovery

behavioral2

socks5systemzbotnetdiscovery

© 2018-2024

Terms | Privacy