#socks5systemz — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #socks5systemz, aggregated by home.social.
-
@da_667 That’s a good question! By the looks of the TCP 1074 traffic the
connectmessages start with two or three null bytes, followed by a 16 bit length field in little endian byte order. The length is the number of characters in the string that follows. Then comes whatever string the C2 server provided afterip=in thec=connectcommand, followed by theclient_idin reversed byte order.The #Socks5Systemz backconnect message format is something like this:
[null bytes][length][ip string][client_id]There are also other message types, but they start with other values than
0x00. One example is when the C2 server sends thec=updipscommand, after which the client connects back to TCP 1074 and sends data starting with0x02instead. The actual backconnect proxy traffic uses0x01. -
The exact same protocol, but without RC4 encryption, was also reverse engineered by Vitali Kremez (RIP 💜) in his ”Let’s Learn: Trickbot Socks5 Backconnect Module In Detail” blog post from 2017.
#TrickBot #TeamSpy #Socks5Systemz
https://vk-intel.org/2017/11/21/lets-learn-trickbot-socks5-backconnect-module-in-detail/ -
The RC4 cipher is actually reset with every C2 message 🤪🤣 This makes it possible to detect #Socks5Systemz bot checkins with a static signature that looks for GET requests that have a QueryString starting with
c=94bf3661c794e3eb1ba4.It’s also possible to identify the C2 commands from the server without having to decrypt them. Here’s a translation table:
94ee3b6dda83d3ec11fc3742➡️c=disconnect94ee3660c585➡️c=idle94ee2a74cd89ccf1➡️c=updips94ee3c6bc78ed9e10b➡️c=connect
-
The C2 protocol in BitSight’s Unveiling Socks5Systemz seems to be identical to what’s described in this old BackDoor.TeamViewer.49 blog post by DrWEB from 2016!
They both even use the same RC4 encryption key
heyfg645fdhwi, which can be used to decrypt requests and responses from the C2. -
Socks5Systemz proxy service delivered via PrivateLoader and Amadey – Source: securityaffairs.com https://ciso2ciso.com/socks5systemz-proxy-service-delivered-via-privateloader-and-amadey-source-securityaffairs-com/ #rssfeedpostgeneratorecho #informationsecuritynews #ITInformationSecurity #SecurityAffairscom #CyberSecurityNews #PierluigiPaganini #SecurityAffairs #SecurityAffairs #Socks5Systemz #BreakingNews #SecurityNews #hackingnews #CyberCrime #Cybercrime #hacking #Malware #botnet
-
"🚨 Rise of #SOCKS5Systemz: A New Proxy Menace 🌐"
The BitSight investigation found that PrivateLoader and the Amadey botnet are now working together, making it easier to distribute malware. This partnership is a big threat because it simplifies how malware is spread.
We also looked into SOCKS5Systemz, a proxy service, and discovered a concerning trend in proxy services. PrivateLoader and Amadey, which used to be separate threats, are now connected, showing a change in how cybercriminals cooperate.
BitSight's latest findings reveal a new proxy service called Socks5Systemz. It's being distributed through PrivateLoader and Amadey, which are common tools for cybercriminals to spread malware. This service sells access to about 10,000 infected systems globally, with no victims in Russia, suggesting the operators may be located there. They offer different subscription levels, paid in cryptocurrency, letting clients hide their internet activity, which poses risks to network security. The botnet spans several European countries and provides standard and VIP subscriptions, meeting various user demands for anonymity.🤝💻🔗
Source: BitSight Blog
Tags: #CyberSecurity #ProxyServices #PrivateLoader #Amadey #CyberThreats #CyberCollaboration #InfoSec #ThreatIntelligence #Malware 🛡️🔍
-
This malware infiltrates computers and transforms them into proxies for forwarding traffic, which can be used for malicious, illegal, or anonymous purposes.