socks5systemz

Sharing

Copy URL

Twitter E-mail

General

Target

d4f2f9fe075c311ef5099232f47eb663de57d55725d22a3c4349d64855befc15
Size

4.8MB
Sample

240627-3cs5dszgrr
MD5

a6ba67ff6e634d920d00ef7a00d5c656
SHA1

8458e8b74fadf0147e35b3f61a74579a739f0c01
SHA256

d4f2f9fe075c311ef5099232f47eb663de57d55725d22a3c4349d64855befc15
SHA512

a04bdf774649ad1e3aee51eb5fd5185fc34d443940dcd66f4e287b19f61e1257aebf4d94c35cbda7de0184222ea994f2b130f90565907c11b0876da77f641cbf
SSDEEP

98304:mNpMY3iIGtnQOSVU+grdHriK0NXR6R9Waqtt8BDEZe4Y1ZWXe25H4x/B:0+gFaNSVUThriKvnWaqtLZtnXr5H4dB

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

ejtbouy.ua

kjobjiv.ua

dtuqjmo.info

http://dtuqjmo.info/search/?q=67e28dd86809f27b415ba51b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a771ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ff614c3ef93983f

Targets

- Target
  
  d4f2f9fe075c311ef5099232f47eb663de57d55725d22a3c4349d64855befc15
- Size
  
  4.8MB
- MD5
  
  a6ba67ff6e634d920d00ef7a00d5c656
- SHA1
  
  8458e8b74fadf0147e35b3f61a74579a739f0c01
- SHA256
  
  d4f2f9fe075c311ef5099232f47eb663de57d55725d22a3c4349d64855befc15
- SHA512
  
  a04bdf774649ad1e3aee51eb5fd5185fc34d443940dcd66f4e287b19f61e1257aebf4d94c35cbda7de0184222ea994f2b130f90565907c11b0876da77f641cbf
- SSDEEP
  
  98304:mNpMY3iIGtnQOSVU+grdHriK0NXR6R9Waqtt8BDEZe4Y1ZWXe25H4x/B:0+gFaNSVUThriKvnWaqtLZtnXr5H4dB
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2