Ancestors

Written by abuse.ch :verified: on 2024-12-05 at 10:41

On the 1st of December, the notorious Socks5Systemz payload server hosted at AS57678 (Cat Technologies 🇭🇰) that is already active for several months started to serve a new version of Socks5Systemz ⤵️

🌐 https://urlhaus.abuse.ch/url/3189430/

This is the first major change since 2023 in Socks5Systemz and includes:

🔑 New RC4 key used during C2 communication: hi_few5i6ab&7#d3

👋 Direct IP communication through HTTP(s) for botnet command and control instead of the usage of a DGA and a custom DNS server

🔙 Backconnect TCP port changed from 2023 to 2024

Current botnet C2 servers:

188.119.66.185:443 CHANGWAY 🇭🇰

45.155.249.212:443 RACKPLACE 🇩🇪

91.211.249.30:443 PODAON 🇱🇻

Malware sample:📄 https://bazaar.abuse.ch/sample/528334ed9e4567a89f3cf4e4700946056499624dcfdd3b32a7800abc08eff9fe/

Socks5Systemz IOCs:🦊 

https://threatfox.abuse.ch/browse/malware/win.socks5_systemz/

=> View attached media | View attached media

=> More informations about this toot | More toots from abuse_ch@ioc.exchange

Written by 𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 on 2024-12-05 at 15:42

@abuse_ch Thanks for the heads up! Reported a new Socks5Systemz backconnect server on 31.214.157.206:2024 to ThreatFox.

https://threatfox.abuse.ch/ioc/1352594/

=> More informations about this toot | More toots from netresec@infosec.exchange

Toot

Written by abuse.ch :verified: on 2024-12-05 at 16:11

@netresec rockstar! Thank you so nich 🙏🏼

=> More informations about this toot | More toots from abuse_ch@ioc.exchange

Descendants