General

  • Target

    5c952be1f66e7b5039bd8918a1067e43b3119f7623723173b58c7d9ccf401914N

  • Size

    5.6MB

  • Sample

    241107-nbj3rstnak

  • MD5

    53bdaa2a0a51ef89b3c5232ce6445710

  • SHA1

    d9478940e768dac1d20095c59c4d200e0282522c

  • SHA256

    5c952be1f66e7b5039bd8918a1067e43b3119f7623723173b58c7d9ccf401914

  • SHA512

    b66aca42554b399fa1c15cbc0dae08462bb549fb2037bfbb18d77915326afd458438a84f17d1f45208549666d5a4d31f6cb5487755c0bacab2662bf3752f1c18

  • SSDEEP

    98304:jiRmxZFsM4kxzDcT+GcY437KvDwEHuujlsaSzsC0p43MpQdZ9nc+fsCb+oSBAON6:2Rm1syxacY48eda2TMpQdZ9nc+fyhNjG

Malware Config

Extracted

Family

socks5systemz

C2

51.159.66.125

217.23.6.51

151.80.38.159

217.23.9.168

37.187.122.227

Attributes
  • rc4_key

    heyfg645fdhwi

Targets

    • Target

      5c952be1f66e7b5039bd8918a1067e43b3119f7623723173b58c7d9ccf401914N

    • Size

      5.6MB

    • MD5

      53bdaa2a0a51ef89b3c5232ce6445710

    • SHA1

      d9478940e768dac1d20095c59c4d200e0282522c

    • SHA256

      5c952be1f66e7b5039bd8918a1067e43b3119f7623723173b58c7d9ccf401914

    • SHA512

      b66aca42554b399fa1c15cbc0dae08462bb549fb2037bfbb18d77915326afd458438a84f17d1f45208549666d5a4d31f6cb5487755c0bacab2662bf3752f1c18

    • SSDEEP

      98304:jiRmxZFsM4kxzDcT+GcY437KvDwEHuujlsaSzsC0p43MpQdZ9nc+fsCb+oSBAON6:2Rm1syxacY48eda2TMpQdZ9nc+fyhNjG

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Socks5systemz family

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks