General

  • Target

    122c44488ca84e528d11fea02c16ddbf93a141f3cf65b2596243630b17dd49bdN

  • Size

    5.6MB

  • Sample

    241107-qw5ajstbjj

  • MD5

    18f9d652265528b4019a062448a4df40

  • SHA1

    596d0ecf010de82a6385829a08e132027c5c05ec

  • SHA256

    122c44488ca84e528d11fea02c16ddbf93a141f3cf65b2596243630b17dd49bd

  • SHA512

    43e64216271294386b9642d1a4c1aa1aff71e634184d4fda0c838da94db96a6a793fff2c96beb79146e66642bbc3233bb23ffe2fb0b95b30784b3a102aa457d9

  • SSDEEP

    98304:ZiRmxZFsM4kxzDcT+GcY437KvDwEHuujlsaSzsC0p43MpQdZ9nc+fsCb+oSBAON6:IRm1syxacY48eda2TMpQdZ9nc+fyhNjG

Malware Config

Extracted

Family

socks5systemz

C2

51.159.66.125

217.23.6.51

151.80.38.159

217.23.9.168

37.187.122.227

Attributes
  • rc4_key

    heyfg645fdhwi

Targets

    • Target

      122c44488ca84e528d11fea02c16ddbf93a141f3cf65b2596243630b17dd49bdN

    • Size

      5.6MB

    • MD5

      18f9d652265528b4019a062448a4df40

    • SHA1

      596d0ecf010de82a6385829a08e132027c5c05ec

    • SHA256

      122c44488ca84e528d11fea02c16ddbf93a141f3cf65b2596243630b17dd49bd

    • SHA512

      43e64216271294386b9642d1a4c1aa1aff71e634184d4fda0c838da94db96a6a793fff2c96beb79146e66642bbc3233bb23ffe2fb0b95b30784b3a102aa457d9

    • SSDEEP

      98304:ZiRmxZFsM4kxzDcT+GcY437KvDwEHuujlsaSzsC0p43MpQdZ9nc+fsCb+oSBAON6:IRm1syxacY48eda2TMpQdZ9nc+fyhNjG

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Socks5systemz family

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks