General

  • Target

    078b0fa60820a7d3ed85486519f4552732fb02cb26772f3bdf9ca000d5c21e18N

  • Size

    5.6MB

  • Sample

    241107-hajsqaxdpc

  • MD5

    91e4f8abbcae8d4116ddf08769851b30

  • SHA1

    fbf6cb5f90d94452989b0aefe7cc7f546ce1d312

  • SHA256

    078b0fa60820a7d3ed85486519f4552732fb02cb26772f3bdf9ca000d5c21e18

  • SHA512

    2b7ab129f50d5eef63d3572f7a0ff97ae6609ac9f43e1976c7a12026df8c9766b854da13d6ccad0b5a2f4ea4d67c85d785e4edd9a5092cca8ec75c0148619566

  • SSDEEP

    98304:kiRmxZFsM4kxzDcT+GcY437KvDwEHuujlsaSzsC0p43MpQdZ9nc+fsCb+oSBAON6:lRm1syxacY48eda2TMpQdZ9nc+fyhNjG

Malware Config

Extracted

Family

socks5systemz

C2

51.159.66.125

217.23.6.51

151.80.38.159

217.23.9.168

37.187.122.227

Attributes
  • rc4_key

    heyfg645fdhwi

Targets

    • Target

      078b0fa60820a7d3ed85486519f4552732fb02cb26772f3bdf9ca000d5c21e18N

    • Size

      5.6MB

    • MD5

      91e4f8abbcae8d4116ddf08769851b30

    • SHA1

      fbf6cb5f90d94452989b0aefe7cc7f546ce1d312

    • SHA256

      078b0fa60820a7d3ed85486519f4552732fb02cb26772f3bdf9ca000d5c21e18

    • SHA512

      2b7ab129f50d5eef63d3572f7a0ff97ae6609ac9f43e1976c7a12026df8c9766b854da13d6ccad0b5a2f4ea4d67c85d785e4edd9a5092cca8ec75c0148619566

    • SSDEEP

      98304:kiRmxZFsM4kxzDcT+GcY437KvDwEHuujlsaSzsC0p43MpQdZ9nc+fsCb+oSBAON6:lRm1syxacY48eda2TMpQdZ9nc+fyhNjG

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Socks5systemz family

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks